danog/psalm
1
0
Fork 0
mirror of https://github.com/danog/psalm.git synced 2025-01-22 05:41:20 +01:00
Code Issues Projects Releases Wiki Activity

Taint through reset call

Browse Source
This commit is contained in:
Matt Brown 2021-03-28 13:14:35 -04:00
parent f24ef253e3
commit f41deeab0a
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/Psalm/Internal/Provider/ReturnTypeProvider/ArrayPointerAdjustmentReturnTypeProvider.php
View File

@ -3,6 +3,7 @@ namespace Psalm\Internal\Provider\ReturnTypeProvider;
use PhpParser;
use Psalm\Plugin\EventHandler\Event\FunctionReturnTypeProviderEvent;
use Psalm\Internal\Analyzer\Statements\Expression\Fetch\ArrayFetchAnalyzer;
use Psalm\Type;
class ArrayPointerAdjustmentReturnTypeProvider implements \Psalm\Plugin\EventHandler\FunctionReturnTypeProviderInterface
@ -77,6 +78,14 @@ class ArrayPointerAdjustmentReturnTypeProvider implements \Psalm\Plugin\EventHan
}
}
ArrayFetchAnalyzer::taintArrayFetch(
$statements_source,
$first_arg,
null,
$value_type,
Type::getMixed()
);
return $value_type;
}
}

11
tests/TaintTest.php
View File

@ -2122,6 +2122,17 @@ class TaintTest extends TestCase
doTheMagic([(string)$_GET["bad"] => "foo"]);',
'error_message' => 'TaintedHtml',
],
'taintThroughReset' => [
'<?php
function foo(array $arr) : void {
if ($arr) {
echo reset($arr);
}
}
foo([$_GET["a"]]);',
'error_message' => 'TaintedHtml',
],
/*
// TODO: Stubs do not support this type of inference even with $this->message = $message.
// Most uses of getMessage() would be with caught exceptions, so this is not representative of real code.