97 Commits

Author	SHA1	Message	Date
Brown	67b2edc328	Allow more things to be suppressed with @psalm-suppress TaintedInput	2020-07-02 11:53:51 -04:00
Brown	ae7c5b095b	Fix #3712 - allow taints to be suppressed with @psalm-suppress	2020-07-01 23:23:45 -04:00
Brown	70ab4c18f4	Fix #3720 - allow literal unions in keys to map to object-like arrays	2020-07-01 18:57:19 -04:00
Brown	dd25b81d3a	Fix #3670 - taint mixed foreach access	2020-06-24 19:16:30 -04:00
Brown	49f0592794	Improve tracking of array taints	2020-06-18 18:48:19 -04:00
Brown	562a7c1ca4	Track taints from all tainted arrays	2020-06-18 13:45:58 -04:00
Brown	f609a01497	Move static property fetch analyzer to own class	2020-06-18 11:53:24 -04:00
Brown	953be61cf2	Allow limiting connected taint paths	2020-05-25 23:28:11 -04:00
Brown	7e7456c863	Make taint checks more thorough	2020-05-25 17:10:53 -04:00
Brown	118b700436	Simplify sink mapping for internal calls	2020-05-25 13:10:06 -04:00
Matthew Brown	1d17c02fba	Fix #3442 - support broader type after initial array assignment	2020-05-23 23:23:50 -04:00
Matthew Brown	187b944680	Add faster taint analysis	2020-05-22 12:33:29 -04:00
Brown	5ee1487a01	Make ExpressionAnalyzer more beautiful	2020-05-18 15:13:27 -04:00
Brown	73f8f963fa	Expand out class constants as early as possible ... Fixes #3128	2020-04-12 20:38:36 -04:00
Brown	9d2957d339	Fix a few more edge-cases	2020-04-12 01:26:11 -04:00
Brown	db7447abd7	Make array coercion-to--mixed rules a little more lenient	2020-04-10 16:21:48 -04:00
Brown	3a4dd70403	Prevent MixedMethodCall from generated array offsetGet calls	2020-04-09 11:45:15 -04:00
Brown	bd92ec6cd3	Detect nested issues	2020-04-09 10:42:54 -04:00
Brown	bd2104c5ba	Merge with mixed in nested arrays	2020-04-09 09:27:21 -04:00
Brown	d868710b2b	Fix handling of built arrays	2020-04-08 16:11:11 -04:00
Brown	067104e170	Fix #3084 - keep track of upper and lower bounds of inferred template types	2020-04-07 00:13:56 -04:00
Brown	fca6585f6e	Be more lenient when inside isset	2020-04-04 11:15:13 -04:00
Matthew Brown	6ad3d039df	Prevent more array<mixed,...> creation	2020-02-22 12:12:40 -05:00
Matthew Brown	db17c85dd6	Fix #2787 - make accessing undefined objectlike key an error	2020-02-22 00:29:59 -05:00
Brown	6e8088776d	Use better return type for SimpleXMLElement::offsetGet	2020-02-18 10:58:56 -05:00
Matthew Brown	653353709a	Use MethodIdentifier object instead of string	2020-02-14 20:54:26 -05:00
Brown	b87161785d	Be even more permissive	2020-02-13 17:58:15 -05:00
Brown	1c42875179	Support lowercase-string and warn about unnecessary calls to strtolower	2020-02-13 16:38:58 -05:00
Brown	3b6f53a356	Revert "Fix #2724 - make sure behaviour is not dependent on array type" ... This reverts commit 1df03b0ff2.	2020-01-31 17:25:15 -05:00
Brown	1df03b0ff2	Fix #2724 - make sure behaviour is not dependent on array type	2020-01-31 16:46:05 -05:00
Matthew Brown	5eb2ebc508	Add more type-system protections for bad array args	2020-01-29 23:41:17 -05:00
Matthew Brown	9fa2db1b6c	Move Union::getTypes to Union::getAtomicTypes	2020-01-04 12:20:26 -05:00
Matthew Brown	55c2f7faa2	Fix #2508 - don’t replace templated types with generic ones inside own function	2019-12-28 18:38:02 -05:00
Matthew Brown	068afa09d3	Add very basic implementation for class-string-map ... Fixes #1969	2019-12-27 12:49:28 -05:00
Brown	e1dd22ef6c	Allow static::class to be used in array assertions	2019-12-04 12:23:26 -05:00
Brown	f97a8f0d5b	Use more accurate way to determine list size	2019-11-26 16:34:19 -05:00
Brown	0bcb7863f3	Use better system for storing inferred types and assertions	2019-11-25 11:44:54 -05:00
Brown	96586f16c0	Fix phpcs issues	2019-11-11 10:11:42 -05:00
Brown	af5f83602e	Break out more specific possibly defined offset errors	2019-11-11 09:59:56 -05:00
Matthew Brown	5910a362ea	Improve report output of taint analysis	2019-10-19 17:59:10 -04:00
Matthew Brown	e5623e9257	Fix function call	2019-10-11 23:33:36 -04:00
Matthew Brown	4478d31593	Taint arrays in creation	2019-10-11 23:28:17 -04:00
Matthew Brown	03c39cbe7c	Fix #2223 - make sure lists are handled in more places	2019-10-10 20:16:43 -04:00
Brown	b75720c32b	Add more list types	2019-10-09 10:04:34 -04:00
Brown	2d4a7fbe3e	Fix array fetch analysis offset	2019-10-08 19:01:00 -04:00
Brown	16c33d1565	Add support for list type ... Fixes #2209	2019-10-08 18:44:46 -04:00
Brown	b0aaede9e1	Add support for checking integer array offsets	2019-10-04 11:08:08 -04:00
Matthew Brown	d85fbaec09	Add stricter checks after first isset	2019-10-03 21:34:56 -04:00
Brown	d225374d6d	Fix #2156 - do better inference after isset	2019-10-01 19:31:08 -04:00
Brown	a81c3067ad	Store the whole type	2019-10-01 17:09:32 -04:00