Merge branch '5.x' into upstream-master

stubs/Reflection.phpstub

@@ -15,6 +15,7 @@ class ReflectionClass implements Reflector {
     /**
      * @param T|class-string<T>|interface-string<T>|trait-string|enum-string<T> $argument
      * @psalm-pure
+     * @psalm-taint-sink callable $argument
      */
     public function __construct($argument) {}
 
@@ -424,7 +425,7 @@ class ReflectionFunction extends ReflectionFunctionAbstract
 {
     /**
      * @param callable-string|Closure $function
-     *
+     * @psalm-taint-sink callable $function
      * @psalm-pure
      */
     public function __construct(callable $function) {}

stubs/extensions/mysqli.phpstub

@@ -1,5 +1,125 @@
 <?php
 
+// Constant list is generated with
+// ```
+// php -r 'foreach ((new ReflectionExtension("mysqli"))->getConstants() as $name => $value) echo "const " . $name . " = " . var_export($value, true) . ";" . PHP_EOL;'
+// ```
+const MYSQLI_READ_DEFAULT_GROUP = 5;
+const MYSQLI_READ_DEFAULT_FILE = 4;
+const MYSQLI_OPT_CONNECT_TIMEOUT = 0;
+const MYSQLI_OPT_LOCAL_INFILE = 8;
+const MYSQLI_OPT_LOAD_DATA_LOCAL_DIR = 43;
+const MYSQLI_INIT_COMMAND = 3;
+const MYSQLI_OPT_READ_TIMEOUT = 11;
+const MYSQLI_OPT_NET_CMD_BUFFER_SIZE = 202;
+const MYSQLI_OPT_NET_READ_BUFFER_SIZE = 203;
+const MYSQLI_OPT_INT_AND_FLOAT_NATIVE = 201;
+const MYSQLI_OPT_SSL_VERIFY_SERVER_CERT = 21;
+const MYSQLI_SERVER_PUBLIC_KEY = 35;
+const MYSQLI_CLIENT_SSL = 2048;
+const MYSQLI_CLIENT_COMPRESS = 32;
+const MYSQLI_CLIENT_INTERACTIVE = 1024;
+const MYSQLI_CLIENT_IGNORE_SPACE = 256;
+const MYSQLI_CLIENT_NO_SCHEMA = 16;
+const MYSQLI_CLIENT_FOUND_ROWS = 2;
+const MYSQLI_CLIENT_SSL_VERIFY_SERVER_CERT = 1073741824;
+const MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT = 64;
+const MYSQLI_CLIENT_CAN_HANDLE_EXPIRED_PASSWORDS = 4194304;
+const MYSQLI_OPT_CAN_HANDLE_EXPIRED_PASSWORDS = 37;
+const MYSQLI_STORE_RESULT = 0;
+const MYSQLI_USE_RESULT = 1;
+const MYSQLI_ASYNC = 8;
+const MYSQLI_STORE_RESULT_COPY_DATA = 16;
+const MYSQLI_ASSOC = 1;
+const MYSQLI_NUM = 2;
+const MYSQLI_BOTH = 3;
+const MYSQLI_STMT_ATTR_UPDATE_MAX_LENGTH = 0;
+const MYSQLI_STMT_ATTR_CURSOR_TYPE = 1;
+const MYSQLI_CURSOR_TYPE_NO_CURSOR = 0;
+const MYSQLI_CURSOR_TYPE_READ_ONLY = 1;
+const MYSQLI_CURSOR_TYPE_FOR_UPDATE = 2;
+const MYSQLI_CURSOR_TYPE_SCROLLABLE = 4;
+const MYSQLI_STMT_ATTR_PREFETCH_ROWS = 2;
+const MYSQLI_NOT_NULL_FLAG = 1;
+const MYSQLI_PRI_KEY_FLAG = 2;
+const MYSQLI_UNIQUE_KEY_FLAG = 4;
+const MYSQLI_MULTIPLE_KEY_FLAG = 8;
+const MYSQLI_BLOB_FLAG = 16;
+const MYSQLI_UNSIGNED_FLAG = 32;
+const MYSQLI_ZEROFILL_FLAG = 64;
+const MYSQLI_AUTO_INCREMENT_FLAG = 512;
+const MYSQLI_TIMESTAMP_FLAG = 1024;
+const MYSQLI_SET_FLAG = 2048;
+const MYSQLI_NUM_FLAG = 32768;
+const MYSQLI_PART_KEY_FLAG = 16384;
+const MYSQLI_GROUP_FLAG = 32768;
+const MYSQLI_ENUM_FLAG = 256;
+const MYSQLI_BINARY_FLAG = 128;
+const MYSQLI_NO_DEFAULT_VALUE_FLAG = 4096;
+const MYSQLI_ON_UPDATE_NOW_FLAG = 8192;
+const MYSQLI_TYPE_DECIMAL = 0;
+const MYSQLI_TYPE_TINY = 1;
+const MYSQLI_TYPE_SHORT = 2;
+const MYSQLI_TYPE_LONG = 3;
+const MYSQLI_TYPE_FLOAT = 4;
+const MYSQLI_TYPE_DOUBLE = 5;
+const MYSQLI_TYPE_NULL = 6;
+const MYSQLI_TYPE_TIMESTAMP = 7;
+const MYSQLI_TYPE_LONGLONG = 8;
+const MYSQLI_TYPE_INT24 = 9;
+const MYSQLI_TYPE_DATE = 10;
+const MYSQLI_TYPE_TIME = 11;
+const MYSQLI_TYPE_DATETIME = 12;
+const MYSQLI_TYPE_YEAR = 13;
+const MYSQLI_TYPE_NEWDATE = 14;
+const MYSQLI_TYPE_ENUM = 247;
+const MYSQLI_TYPE_SET = 248;
+const MYSQLI_TYPE_TINY_BLOB = 249;
+const MYSQLI_TYPE_MEDIUM_BLOB = 250;
+const MYSQLI_TYPE_LONG_BLOB = 251;
+const MYSQLI_TYPE_BLOB = 252;
+const MYSQLI_TYPE_VAR_STRING = 253;
+const MYSQLI_TYPE_STRING = 254;
+const MYSQLI_TYPE_CHAR = 1;
+const MYSQLI_TYPE_INTERVAL = 247;
+const MYSQLI_TYPE_GEOMETRY = 255;
+const MYSQLI_TYPE_JSON = 245;
+const MYSQLI_TYPE_NEWDECIMAL = 246;
+const MYSQLI_TYPE_BIT = 16;
+const MYSQLI_SET_CHARSET_NAME = 7;
+const MYSQLI_SET_CHARSET_DIR = 6;
+const MYSQLI_NO_DATA = 100;
+const MYSQLI_DATA_TRUNCATED = 101;
+const MYSQLI_REPORT_INDEX = 4;
+const MYSQLI_REPORT_ERROR = 1;
+const MYSQLI_REPORT_STRICT = 2;
+const MYSQLI_REPORT_ALL = 255;
+const MYSQLI_REPORT_OFF = 0;
+const MYSQLI_DEBUG_TRACE_ENABLED = 0;
+const MYSQLI_SERVER_QUERY_NO_GOOD_INDEX_USED = 16;
+const MYSQLI_SERVER_QUERY_NO_INDEX_USED = 32;
+const MYSQLI_SERVER_QUERY_WAS_SLOW = 2048;
+const MYSQLI_SERVER_PS_OUT_PARAMS = 4096;
+const MYSQLI_REFRESH_GRANT = 1;
+const MYSQLI_REFRESH_LOG = 2;
+const MYSQLI_REFRESH_TABLES = 4;
+const MYSQLI_REFRESH_HOSTS = 8;
+const MYSQLI_REFRESH_STATUS = 16;
+const MYSQLI_REFRESH_THREADS = 32;
+const MYSQLI_REFRESH_REPLICA = 64;
+const MYSQLI_REFRESH_SLAVE = 64;
+const MYSQLI_REFRESH_MASTER = 128;
+const MYSQLI_REFRESH_BACKUP_LOG = 2097152;
+const MYSQLI_TRANS_START_WITH_CONSISTENT_SNAPSHOT = 1;
+const MYSQLI_TRANS_START_READ_WRITE = 2;
+const MYSQLI_TRANS_START_READ_ONLY = 4;
+const MYSQLI_TRANS_COR_AND_CHAIN = 1;
+const MYSQLI_TRANS_COR_AND_NO_CHAIN = 2;
+const MYSQLI_TRANS_COR_RELEASE = 4;
+const MYSQLI_TRANS_COR_NO_RELEASE = 8;
+/** @var bool */
+const MYSQLI_IS_MARIADB = false;
+
 class mysqli
 {
     /**
@@ -82,3 +202,9 @@ class mysqli_stmt
  * @return T|null|false
  */
 function mysqli_fetch_object(mysqli_result $result, string $class = stdClass::class, array $constructor_args = []): object|false|null {}
+
+
+final class mysqli_sql_exception extends RuntimeException implements Stringable, Throwable {
+  protected string $sqlstate = '00000';
+  public function getSqlState(): string {}
+}

tests/TaintTest.php

@@ -2489,6 +2489,20 @@ class TaintTest extends TestCase
                     echo pg_escape_string($conn, $_GET["a"]);',
                 'error_message' => 'TaintedHtml',
             ],
+            'taintedReflectionClass' => [
+                'code' => '<?php
+                    $name = $_GET["name"];
+                    $reflector = new ReflectionClass($name);
+                    $reflector->newInstance();',
+                'error_message' => 'TaintedCallable',
+            ],
+            'taintedReflectionFunction' => [
+                'code' => '<?php
+                    $name = $_GET["name"];
+                    $function = new ReflectionFunction($name);
+                    $function->invoke();',
+                'error_message' => 'TaintedCallable',
+            ],
         ];
     }