danog/psalm
1
0
Fork 0
mirror of https://github.com/danog/psalm.git synced 2025-01-22 13:51:54 +01:00
Code Issues Projects Releases Wiki Activity

Merge pull request #8848 from mmcev106/urlencode

Browse Source
This commit is contained in:
Bruce Weirdan 2022-12-05 21:17:34 -04:00 committed by GitHub
commit 4dc969b887
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
stubs/CoreGenericFunctions.phpstub
View File

@ -837,6 +837,15 @@ function htmlspecialchars(string $string, int $flags = ENT_COMPAT | ENT_HTML401,
*/ */
function htmlspecialchars_decode(string $string, ?int $flags = null) : string {} function htmlspecialchars_decode(string $string, ?int $flags = null) : string {}
/**
* @psalm-pure
*
* @psalm-taint-escape html
* @psalm-taint-escape has_quotes
* @psalm-flow ($string) -> return
*/
function urlencode(string $string) : string {}
/** /**
* @psalm-pure * @psalm-pure
* *

16
tests/TaintTest.php
View File

@ -722,6 +722,11 @@ class TaintTest extends TestCase
} }
}' }'
], ],
'urlencode' => [
'code' => '<?php
echo urlencode($_GET["bad"]);
'
],
]; ];
} }
@ -2373,6 +2378,17 @@ class TaintTest extends TestCase
new $a($b);', new $a($b);',
'error_message' => 'TaintedCallable', 'error_message' => 'TaintedCallable',
], ],
'urlencode' => [
/**
* urlencode() should only prevent html & has_quotes taints
* All other taint types should be unaffected.
* We arbitrarily chose system() to test this.
*/
'code' => '<?php
system(urlencode($_GET["bad"]));
',
'error_message' => 'TaintedShell'
]
]; ];
} }