Matt Brown
|
b5a3f45d52
|
Remove use of PHP 7.2 function
|
2020-11-04 11:02:34 -05:00 |
|
Matt Brown
|
09228131d8
|
Use falsy value
|
2020-11-01 22:57:30 -05:00 |
|
Matt Brown
|
966b139504
|
Fix dupe semicolons
|
2020-11-01 11:42:09 -05:00 |
|
Matt Brown
|
024d93b7fd
|
Fix #4467 - variables are only the same if they were set in the same location
|
2020-11-01 11:26:42 -05:00 |
|
Matt Brown
|
fe294a4dc0
|
Don’t overwrite true flag
|
2020-10-18 01:24:36 -04:00 |
|
Matt Brown
|
3c29ffd0b7
|
Ignore just-coerced vars
|
2020-10-17 23:35:24 -04:00 |
|
Matt Brown
|
4488d5fb1f
|
Use more accurate arguments count
|
2020-10-14 18:51:15 -04:00 |
|
Matt Brown
|
724b25b918
|
Change control_flow_graph to data_flow_graph
|
2020-10-13 17:28:12 -04:00 |
|
Matt Brown
|
516141a380
|
Rename ControlFlowGraph to more appropriate DataFlowGraph
|
2020-10-13 16:49:03 -04:00 |
|
Matt Brown
|
fcfa746ba8
|
Fix #4310 - prevent literal class check on union
|
2020-10-12 14:45:11 -04:00 |
|
Matt Brown
|
7195275993
|
Fix #4299 - only allow unpacking for the zeroeth-indexed element
|
2020-10-08 09:51:27 -04:00 |
|
Matt Brown
|
009b33b17d
|
Support @no-named-args when calling in PHP 8
|
2020-10-02 20:58:51 -04:00 |
|
Matt Brown
|
63a11bae15
|
4.x - Support named arguments
Ref #4089
|
2020-10-02 20:27:01 -04:00 |
|
Matt Brown
|
fc001cdf65
|
Treat func_get_args as using function params
|
2020-09-30 13:08:01 -04:00 |
|
Matt Brown
|
14efde286f
|
4.x - refactor unused variable detection
This turns unused variable detection into an explicit control-flow problem, where before we had a more simplistic mark-and-sweep algorithm
|
2020-09-30 12:28:13 -04:00 |
|
Brown
|
da65a4327f
|
Move taint graph functionality into its own object
|
2020-09-25 00:37:40 -04:00 |
|
orklah
|
83ca918824
|
preg_split can't take null in limit (#4236)
* preg_split can't take null in limit
* fix wrong type in preg_split
|
2020-09-22 13:46:37 -04:00 |
|
Brown
|
56cddd16bf
|
Rename TaintGraph to ControlFlowGraph because it’s about to do more
|
2020-09-20 23:59:52 -04:00 |
|
Brown
|
0f6a271858
|
Improve file-based suppression of taints
|
2020-09-20 19:37:25 -04:00 |
|
Brown
|
2968b3b065
|
Add to StatementsAnalyzer taint object instead of Context
|
2020-09-20 18:42:21 -04:00 |
|
Brown
|
abb9502921
|
Rename Taint object to TaintGraph
|
2020-09-20 18:27:02 -04:00 |
|
Brown
|
77e84b3817
|
Fix a few more things
|
2020-09-13 23:28:31 -04:00 |
|
Brown
|
249903e18a
|
Fix style issues
|
2020-09-13 21:45:07 -04:00 |
|
Brown
|
56bae3b587
|
Add check for strpos dictionaries
Ref #4070
|
2020-09-13 21:42:44 -04:00 |
|
orklah
|
da47588f91
|
replace return; by return null; in every non-void method, add return null; when mising, add return types, remove redundant phpdoc (#4176)
|
2020-09-13 16:39:06 -04:00 |
|
Brown
|
6ffe471525
|
Make new InvalidLiteralArgument issue for strpos refs
Ref #4070
|
2020-09-10 22:54:32 -04:00 |
|
Brown
|
aaede393d4
|
Fix #4070 - prevent literal strpos argument
|
2020-09-10 18:28:34 -04:00 |
|
Brown
|
fe4af8ff1a
|
Minor fixes
|
2020-09-07 17:22:43 -04:00 |
|
Matthew Brown
|
422271b2cf
|
Prevent variables named "haystack" from receiving literal strings
cc @staabm
|
2020-09-05 00:35:48 -04:00 |
|
Brown
|
4d82d3ddad
|
Fix #4128 - improve understanding of preg_match_all
|
2020-09-04 18:10:14 -04:00 |
|
orklah
|
f66d57f19d
|
add native return types (#4116)
* add native return types
* remove redundant phpdoc
|
2020-09-04 16:26:33 -04:00 |
|
orklah
|
73f6fcde48
|
Short list syntax (#4102)
* Short list syntax
* revert unrelated CS
|
2020-09-02 00:17:41 -04:00 |
|
Brown
|
92239add4d
|
Add some backwards-incompatible changes for 4.x
|
2020-08-30 11:44:14 -04:00 |
|
Brown
|
76bd5b6278
|
Refactor type comparison
|
2020-07-21 19:40:35 -04:00 |
|
Evgeniy
|
2c51f47ff6
|
Fix invalid UndefinedClass using array|callable (#3842)
* Do not treat string array argument as callable if it can be traeted just as string array.
* cs
|
2020-07-20 04:50:07 -04:00 |
|
jarstelfox
|
3096afed99
|
Fix echo false issue (#3751)
* Echo: add failing test case
echo false; is a noop, not an issue
* Echo: Fix failing test case
|
2020-07-05 08:55:42 -04:00 |
|
Brown
|
ae7c5b095b
|
Fix #3712 - allow taints to be suppressed with @psalm-suppress
|
2020-07-01 23:23:45 -04:00 |
|
Brown
|
cff976049d
|
Remove unused vars
|
2020-06-29 13:24:05 -04:00 |
|
Brown
|
f6e2e0a84a
|
Perform string casting for taints in ArgumentAnalyzer
|
2020-06-29 13:21:33 -04:00 |
|
Brown
|
95bf7f835b
|
Improve handling of array_map, faking out calls where nececssary
|
2020-06-25 13:05:34 -04:00 |
|
Brown
|
a6c7a48387
|
Add support for argument unpacking
Ref #3670
|
2020-06-24 18:43:15 -04:00 |
|
Brown
|
36f1630e03
|
Add more steps for clearer output
|
2020-06-22 01:08:58 -04:00 |
|
Brown
|
eecdc43ce7
|
Remove stray commas
|
2020-06-18 20:15:38 -04:00 |
|
Brown
|
49f0592794
|
Improve tracking of array taints
|
2020-06-18 18:48:19 -04:00 |
|
Brown
|
f609a01497
|
Move static property fetch analyzer to own class
|
2020-06-18 11:53:24 -04:00 |
|
Matthew Brown
|
74a34f066c
|
Don’t check classes if literal strings are allowed
Fixes #3538
|
2020-06-06 19:31:42 -04:00 |
|
Brown
|
3da3d61270
|
Fix #3434 by removing extraneous call to simplifyType
|
2020-05-26 17:55:54 -04:00 |
|
Brown
|
953be61cf2
|
Allow limiting connected taint paths
|
2020-05-25 23:28:11 -04:00 |
|
Brown
|
7e7456c863
|
Make taint checks more thorough
|
2020-05-25 17:10:53 -04:00 |
|
Brown
|
118b700436
|
Simplify sink mapping for internal calls
|
2020-05-25 13:10:06 -04:00 |
|