danog/psalm
1
0
Fork 0
mirror of https://github.com/danog/psalm.git synced 2024-11-27 04:45:20 +01:00
Code Issues Projects Releases Wiki Activity

Merge pull request #6813 from orklah/intTaint

Browse Source 
don't register taints for numeric variables
This commit is contained in:
orklah 2021-11-04 15:30:52 +01:00 committed by GitHub
commit cd74f665dc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Psalm/Internal/Analyzer/Statements/EchoAnalyzer.php
View File

@ -38,7 +38,7 @@ class EchoAnalyzer
$expr_type = $statements_analyzer->node_data->getType($expr);
if ($statements_analyzer->data_flow_graph instanceof TaintFlowGraph) {
if ($expr_type) {
if ($expr_type && $expr_type->hasObjectType()) {
$expr_type = CastAnalyzer::castStringAttempt(
$statements_analyzer,
$context,

8
src/Psalm/Internal/Analyzer/Statements/Expression/Call/ArgumentAnalyzer.php
View File

@ -1505,6 +1505,14 @@ class ArgumentAnalyzer
return $input_type;
}
// numeric types can't be tainted
if ($statements_analyzer->data_flow_graph instanceof TaintFlowGraph
&& $input_type->isSingle()
&& ($input_type->isInt() || $input_type->isFloat())
) {
return $input_type;
}
$event = new AddRemoveTaintsEvent($expr, $context, $statements_analyzer, $codebase);
$added_taints = $codebase->config->eventDispatcher->dispatchAddTaints($event);

15
tests/TaintTest.php
View File

@ -616,6 +616,21 @@ class TaintTest extends TestCase
echo foo($_GET["foo"], true);
echo foo($_GET["foo"]);'
],
'NoTaintForInt' => [
'<?php // --taint-analysis
function foo(int $value): void {
echo $value;
}
foo($_GET["foo"]);
function bar(): int {
return $_GET["foo"];
}
echo bar();'
],
'conditionallyEscapedTaintPassedTrueStaticCall' => [
'<?php
class U {