Brown
95bf7f835b
Improve handling of array_map, faking out calls where nececssary
2020-06-25 13:05:34 -04:00
Brown
a6c7a48387
Add support for argument unpacking
...
Ref #3670
2020-06-24 18:43:15 -04:00
Brown
7a7cd91c24
Fix #3631 - better treatment for assignments in complex conditionals
2020-06-24 13:16:52 -04:00
Brown
9aa0aca949
Fix handling of coerced callmap args
2020-06-24 11:51:31 -04:00
Brown
c29b3744ec
Change storage of out types
2020-06-24 11:51:31 -04:00
Brown
13fc8a75fd
Allow taints to flow where no return type exists
...
Fixes #3652
2020-06-23 15:52:19 -04:00
Brown
1f86afece7
Revert "Fix #3631 - apply assertions to RHS of equality in conditional"
...
This reverts commit 9c17795545
.
2020-06-22 20:01:27 -04:00
Brown
fc8212e207
Fix static call specialisation via annotation
2020-06-22 18:40:43 -04:00
Brown
e8be2c500e
Support taint flows in more functions
2020-06-22 17:53:03 -04:00
Brown
9c17795545
Fix #3631 - apply assertions to RHS of equality in conditional
2020-06-22 15:16:16 -04:00
Brown
36f1630e03
Add more steps for clearer output
2020-06-22 01:08:58 -04:00
Brown
02e8313c39
Allow taintedness to propagate to some stubbed methods
2020-06-21 18:07:39 -04:00
Brown
07adecc6eb
Use correct method id when creating taints
2020-06-21 02:06:08 -04:00
Brown
dc83c2e2fc
Add annotation for taint sources
2020-06-21 00:58:56 -04:00
Brown
f21d3a8346
Remove html and sql taints for simple preg_replace patterns
2020-06-20 23:11:42 -04:00
Brown
8edee96d8d
Fix taint regression
2020-06-20 18:10:01 -04:00
Brown
80ed1daf33
Allow static method mixin to invoke instance method
2020-06-20 18:05:35 -04:00
Ilija Tovilo
2f646d29db
Fix #3607 - constant string class reference with leading backslash ( #3612 )
2020-06-19 18:02:39 -04:00
Andrei Petre
6024fe4761
use original case in error messages when reporting undefined methods ( #3615 )
2020-06-19 11:51:08 -04:00
Brown
b1c836e5f3
Improve specialisation after call
2020-06-19 01:59:45 -04:00
Brown
8f2e28c36b
Improve tainting of specializable classes
2020-06-19 01:22:51 -04:00
Brown
eecdc43ce7
Remove stray commas
2020-06-18 20:15:38 -04:00
Brown
49f0592794
Improve tracking of array taints
2020-06-18 18:48:19 -04:00
Brown
f609a01497
Move static property fetch analyzer to own class
2020-06-18 11:53:24 -04:00
Olle Härstedt
e1cc27f7a2
Add new config: sealAllMethods ( #3578 )
...
* Add new config: sealAllMethods
* Add some more tests
* Fix codesniffer issue with preg_quote
* Fix missing method in test
Co-authored-by: Olle <noemail>
2020-06-15 22:36:42 -04:00
Brown
03e9649d49
Fix tainting of function calls absent taintable params
2020-06-15 20:59:48 -04:00
Brown
8c5a434dc8
Allow updating array by reference
2020-06-15 14:45:08 -04:00
Matthew Brown
081a284759
Fix #3567 - remember which variables a callable sets byref in use
2020-06-14 11:58:50 -04:00
Matthew Brown
a49a0e5650
Fix #3551 - count method can be impure
2020-06-14 11:06:53 -04:00
Brown
9bfe50b20a
Always analyse cast expressions
...
Fixes #3577
2020-06-12 17:25:46 -04:00
Brown
5617e9d7c9
Fix array_values call
2020-06-09 19:06:08 -04:00
Brown
286a8f911a
Add support for static mixin calls
...
Fixes #3552
2020-06-09 18:39:52 -04:00
Matthew Brown
91e76f7173
Fix #3536 - Make method return type provider aware of original called method
2020-06-06 23:35:08 -04:00
Matthew Brown
0ac739fd48
Fix #3534 - allow magic method call on mixin
2020-06-06 23:28:32 -04:00
Matthew Brown
74a34f066c
Don’t check classes if literal strings are allowed
...
Fixes #3538
2020-06-06 19:31:42 -04:00
Brown
cf92361338
Fix #3522 - only use property pass-through when it’s visible
2020-06-04 16:15:07 -04:00
Brown
a4aa44494f
Fix #3519 - prevent empty callable string
2020-06-04 15:40:53 -04:00
El Azimov
bed5a74065
Add wildcard support for class constants in template. ( #3489 )
...
Co-authored-by: El Azimov <el.azimov@rocks>
2020-05-30 16:55:18 -04:00
feek
5330dcbd7a
fix: pass along final ( #3471 )
2020-05-28 01:59:24 -04:00
Brown
3c60609c21
Support better mixin handling
2020-05-27 11:12:09 -04:00
Brown
769ac5c052
Fix #3458 - scope templated mixin accurately
2020-05-26 23:32:07 -04:00
Brown
d04e21ee5a
Define mixin declaring classname
2020-05-26 23:32:07 -04:00
Brown
3da3d61270
Fix #3434 by removing extraneous call to simplifyType
2020-05-26 17:55:54 -04:00
Brown
ecb179c784
Migrate min/max function calls back to CallMap
2020-05-26 12:28:56 -04:00
Brown
953be61cf2
Allow limiting connected taint paths
2020-05-25 23:28:11 -04:00
Brown
7e7456c863
Make taint checks more thorough
2020-05-25 17:10:53 -04:00
Brown
2e6fc24867
Template callmap methods too
...
Fixes #3453
2020-05-25 14:21:06 -04:00
Brown
118b700436
Simplify sink mapping for internal calls
2020-05-25 13:10:06 -04:00
Brown
be847472a2
Fix #3453 - allow conditional return types on instance methods
2020-05-25 09:39:30 -04:00
Brown
92a9a7efdf
Handle flows into arguments a little better
2020-05-23 23:54:16 -04:00