Samuel Mortenson
4aabb411a8
Added event to prevent tainting. ( #5398 )
...
* Added event to prevent tainting.
* Remove optional codebase parameter.
* Removed falsy check for codebase.
* Use two separate hooks for adding and removing taints
* Add slashes
* Update add/remove taint test name.
* Cleaned up SafeArrayKeyChecker example plugin.
* Added more AddRemoveTaintsEvent calls to codebase.
* Fix type check error with $added_taints param.
* Added AddRemoveTaintsEvent to remaining classes.
* Fix post-merge error.
* Add comma
* Remove $int_offset that never existed
Co-authored-by: Matt Brown <github@muglug.com>
2021-03-19 22:41:41 -04:00
Matt Brown
b7a68edd0b
Simplify complex methods
2021-03-18 15:09:03 -04:00
Matt Brown
3106635953
Fix inference of conditional types when wildcard constant given
2021-02-20 12:21:52 -05:00
Matt Brown
8b5e0fc754
Fix #5172 - prevent calling function with implicitly-broader type
2021-02-07 11:07:22 -05:00
Matthew Brown
28d2795e59
Fix #5078 - when unpacking with missing array item, Use the param’s default type if param has one
2021-01-22 00:20:51 -05:00
orklah
f9fccb2b2d
implement DTO for plugins ( #4881 )
...
* implement DTO for plugins
* introduce EventHandler + reintroduce legacy API for plugins
2021-01-06 09:05:53 -05:00
Matthew Brown
d406d5b112
Fix typo
2020-12-07 01:32:18 -05:00
Matt Brown
e702e472fc
Support simple list assignment in foreach
...
Ref #4741
2020-12-06 19:14:52 -05:00
Matt Brown
cec8d7138f
Fix #4782 - don’t replace closure types with upper bounds when replacing class param types
2020-12-05 11:58:55 -05:00
Matt Brown
86b6d6a506
Fix #4733 - don’t replace template types when they’re defined on the same class
2020-11-29 19:12:22 -05:00
Matt Brown
601c1d8cd0
Expand out constants in param types earlier
2020-11-29 19:07:35 -05:00
Matt Brown
ea314cc1c0
Simplify calling of replacer methods
2020-11-29 16:27:00 -05:00
Matt Brown
4d22723525
Break out replacement of templated types with their inferred result
2020-11-29 16:16:16 -05:00
Matt Brown
6db8132b4c
Simplify call analysers a bit
...
Ref #4714
2020-11-27 16:31:10 -05:00
Matt Brown
5f065d3d74
Turn template bound tuples into object
...
Ref #4714
2020-11-27 11:43:30 -05:00
Matt Brown
9a03a9a5d0
Move param taint sink addition after arguuments have been analysed
2020-11-22 19:39:40 -05:00
orklah
ae0486529e
Unused psalm-suppress ( #4646 )
2020-11-21 17:39:40 -05:00
Matt Brown
8dd229f6c0
Only ignore literal flows when tainting
2020-11-18 18:43:41 -05:00
Matt Brown
236292ff05
Fix #4600 - set attributes in a bunch of places
2020-11-18 12:44:59 -05:00
Matt Brown
3f7f959726
Fix #4599 - propagate taints to parent callers where necessary
2020-11-18 09:59:54 -05:00
Matt Brown
28dee4146a
Fix tests
2020-11-17 17:53:46 -05:00
Matt Brown
adeaa33a64
Don’t propagate taints to child constructor args
2020-11-17 16:49:29 -05:00
Matt Brown
2f7bf2a144
Bind lower bounds to upper bounds as well when no upper bound can be inferred
...
Ref #4485
2020-11-11 17:46:09 -05:00
Matt Brown
b731b53d5e
Add debug stuff for code complexity
2020-11-10 12:49:42 -05:00
Matt Brown
e27cbfba57
Reduce size of data flow graph when analysing array assignments
2020-11-09 22:44:36 -05:00
Matt Brown
3e9c5d3600
Add support for @return never
2020-11-04 12:30:02 -05:00
Matt Brown
b5a3f45d52
Remove use of PHP 7.2 function
2020-11-04 11:02:34 -05:00
Matt Brown
09228131d8
Use falsy value
2020-11-01 22:57:30 -05:00
Matt Brown
966b139504
Fix dupe semicolons
2020-11-01 11:42:09 -05:00
Matt Brown
024d93b7fd
Fix #4467 - variables are only the same if they were set in the same location
2020-11-01 11:26:42 -05:00
Matt Brown
fe294a4dc0
Don’t overwrite true flag
2020-10-18 01:24:36 -04:00
Matt Brown
3c29ffd0b7
Ignore just-coerced vars
2020-10-17 23:35:24 -04:00
Matt Brown
4488d5fb1f
Use more accurate arguments count
2020-10-14 18:51:15 -04:00
Matt Brown
724b25b918
Change control_flow_graph to data_flow_graph
2020-10-13 17:28:12 -04:00
Matt Brown
516141a380
Rename ControlFlowGraph to more appropriate DataFlowGraph
2020-10-13 16:49:03 -04:00
Matt Brown
fcfa746ba8
Fix #4310 - prevent literal class check on union
2020-10-12 14:45:11 -04:00
Matt Brown
7195275993
Fix #4299 - only allow unpacking for the zeroeth-indexed element
2020-10-08 09:51:27 -04:00
Matt Brown
009b33b17d
Support @no-named-args when calling in PHP 8
2020-10-02 20:58:51 -04:00
Matt Brown
63a11bae15
4.x - Support named arguments
...
Ref #4089
2020-10-02 20:27:01 -04:00
Matt Brown
fc001cdf65
Treat func_get_args as using function params
2020-09-30 13:08:01 -04:00
Matt Brown
14efde286f
4.x - refactor unused variable detection
...
This turns unused variable detection into an explicit control-flow problem, where before we had a more simplistic mark-and-sweep algorithm
2020-09-30 12:28:13 -04:00
Brown
da65a4327f
Move taint graph functionality into its own object
2020-09-25 00:37:40 -04:00
orklah
83ca918824
preg_split can't take null in limit ( #4236 )
...
* preg_split can't take null in limit
* fix wrong type in preg_split
2020-09-22 13:46:37 -04:00
Brown
56cddd16bf
Rename TaintGraph to ControlFlowGraph because it’s about to do more
2020-09-20 23:59:52 -04:00
Brown
0f6a271858
Improve file-based suppression of taints
2020-09-20 19:37:25 -04:00
Brown
2968b3b065
Add to StatementsAnalyzer taint object instead of Context
2020-09-20 18:42:21 -04:00
Brown
abb9502921
Rename Taint object to TaintGraph
2020-09-20 18:27:02 -04:00
Brown
77e84b3817
Fix a few more things
2020-09-13 23:28:31 -04:00
Brown
249903e18a
Fix style issues
2020-09-13 21:45:07 -04:00
Brown
56bae3b587
Add check for strpos dictionaries
...
Ref #4070
2020-09-13 21:42:44 -04:00
