No false-positives for tainting through array keys

src/Psalm/Internal/Codebase/DataFlowGraph.php

@@ -63,7 +63,9 @@ abstract class DataFlowGraph
     ) : bool {
         $el = strlen($expression_type);
 
-        if (substr($path_type, 0, $el + 7) === $expression_type . '-fetch-') {
+        // arraykey-fetch requires a matching arraykey-assignment at the same level
+        // otherwise the tainting is not valid
+        if (substr($path_type, 0, $el + 7) === $expression_type . '-fetch-' || $path_type === 'arraykey-fetch') {
             $fetch_nesting = 0;
 
             $previous_path_types = array_reverse($previous_path_types);

tests/TaintTest.php

@@ -630,6 +630,16 @@ class TaintTest extends TestCase
                     echo U::foo($_GET["foo"], true);
                     echo U::foo($_GET["foo"]);'
             ],
+            'keysAreNotTainted' => [
+                '<?php
+                    function takesArray(array $arr): void {
+                        foreach ($arr as $key => $_) {
+                            echo $key;
+                        }
+                    }
+
+                    takesArray(["good" => $_GET["bad"]]);'
+            ],
         ];
     }
 
@@ -2128,15 +2138,15 @@ class TaintTest extends TestCase
                     $res = Wdb::query("SELECT blah FROM tablea ORDER BY ". $order. " DESC");',
                 'error_message' => 'TaintedSql',
             ],
-            'taintArrayKey' => [
+            'keysAreTainted' => [
                 '<?php
-                    function doTheMagic(array $values) {
+                    function takesArray(array $arr): void {
-                        foreach ($values as $key => $value) {
+                        foreach ($arr as $key => $_) {
-                            echo $key . " " . $value;
+                            echo $key;
                         }
                     }
 
-                    doTheMagic([(string)$_GET["bad"] => "foo"]);',
+                    takesArray([$_GET["bad"] => "good"]);',
                 'error_message' => 'TaintedHtml',
             ],
             'taintArrayKeyWithExplicitSink' => [