danog/psalm
1
0
Fork 0
mirror of https://github.com/danog/psalm.git synced 2025-01-22 13:51:54 +01:00
Code Issues Projects Releases Wiki Activity

Merge pull request #8848 from mmcev106/urlencode

Browse Source
This commit is contained in:
Bruce Weirdan 2022-12-05 21:17:34 -04:00 committed by GitHub
commit 4dc969b887
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
stubs/CoreGenericFunctions.phpstub
View File

@ -837,6 +837,15 @@ function htmlspecialchars(string $string, int $flags = ENT_COMPAT | ENT_HTML401,
*/
function htmlspecialchars_decode(string $string, ?int $flags = null) : string {}
/**
* @psalm-pure
*
* @psalm-taint-escape html
* @psalm-taint-escape has_quotes
* @psalm-flow ($string) -> return
*/
function urlencode(string $string) : string {}
/**
* @psalm-pure
*

16
tests/TaintTest.php
View File

@ -722,6 +722,11 @@ class TaintTest extends TestCase
}
}'
],
'urlencode' => [
'code' => '<?php
echo urlencode($_GET["bad"]);
'
],
];
}
@ -2373,6 +2378,17 @@ class TaintTest extends TestCase
new $a($b);',
'error_message' => 'TaintedCallable',
],
'urlencode' => [
/**
* urlencode() should only prevent html & has_quotes taints
* All other taint types should be unaffected.
* We arbitrarily chose system() to test this.
*/
'code' => '<?php
system(urlencode($_GET["bad"]));
',
'error_message' => 'TaintedShell'
]
];
}