1703 Commits

Author	SHA1	Message	Date
Brown	17558a5c0e	Fix #3676 - add multiline output for TaintedInput issues	2020-06-30 13:17:51 -04:00
Brown	671009a70c	Specialize constructor taints cc @TysonAndre	2020-06-29 21:08:43 -04:00
Brown	ab29ac0e51	Only cast in echo when tracking taints	2020-06-29 15:06:11 -04:00
Brown	cff976049d	Remove unused vars	2020-06-29 13:24:05 -04:00
Brown	f6e2e0a84a	Perform string casting for taints in ArgumentAnalyzer	2020-06-29 13:21:33 -04:00
Brown	45c21853e5	Fix #3709 - don’t crash on inherited __toString tainting	2020-06-29 12:11:11 -04:00
Brown	aab90fb74e	Fix Psalm errors	2020-06-29 09:29:19 -04:00
Brown	38977d797e	Fix #3697 - cast types via implied __toString method	2020-06-29 09:13:19 -04:00
Brown	b54b832838	Break out method call tainting	2020-06-29 00:14:49 -04:00
Brown	bcd7478352	Reduce memory footprint a little	2020-06-25 19:12:30 -04:00
Brown	559b3d3471	Fix #3681 - taint exit like echo	2020-06-25 17:17:08 -04:00
Brown	95bf7f835b	Improve handling of array_map, faking out calls where nececssary	2020-06-25 13:05:34 -04:00
Brown	b84cf74754	Fix #3668 - taint property types for magic properties without @property	2020-06-25 00:24:37 -04:00
Brown	dd25b81d3a	Fix #3670 - taint mixed foreach access	2020-06-24 19:16:30 -04:00
Brown	a6c7a48387	Add support for argument unpacking ... Ref #3670	2020-06-24 18:43:15 -04:00
Tyson Andre	1670848267	Mark print() statement as the same sink type as echo (#3669)	2020-06-24 17:23:16 -04:00
Brown	7a7cd91c24	Fix #3631 - better treatment for assignments in complex conditionals	2020-06-24 13:16:52 -04:00
Brown	9aa0aca949	Fix handling of coerced callmap args	2020-06-24 11:51:31 -04:00
Brown	c29b3744ec	Change storage of out types	2020-06-24 11:51:31 -04:00
Brown	96d05ab06b	Fix #3654 - use correct function id for namespaced functions	2020-06-23 16:53:11 -04:00
Brown	6a746b65ea	Fix #3655 - taint encapsulated strings	2020-06-23 16:38:59 -04:00
Brown	13fc8a75fd	Allow taints to flow where no return type exists ... Fixes #3652	2020-06-23 15:52:19 -04:00
Brown	f72b609d42	Fix #3642 - detect missing property when name matches	2020-06-23 13:12:46 -04:00
Brown	4d6fc4d0ca	Fix get_class($foo) === static::class checks	2020-06-23 13:11:19 -04:00
Brown	1f86afece7	Revert "Fix #3631 - apply assertions to RHS of equality in conditional" ... This reverts commit 9c17795545.	2020-06-22 20:01:27 -04:00
Brown	fc8212e207	Fix static call specialisation via annotation	2020-06-22 18:40:43 -04:00
Brown	e8be2c500e	Support taint flows in more functions	2020-06-22 17:53:03 -04:00
Brown	7f05b3c530	Add $_REQUEST as a taint source ... Ref #3636	2020-06-22 17:16:15 -04:00
Brown	9c17795545	Fix #3631 - apply assertions to RHS of equality in conditional	2020-06-22 15:16:16 -04:00
Brown	dddc159694	Add explicit path object	2020-06-22 02:10:03 -04:00
Brown	36f1630e03	Add more steps for clearer output	2020-06-22 01:08:58 -04:00
Brown	02e8313c39	Allow taintedness to propagate to some stubbed methods	2020-06-21 18:07:39 -04:00
Brown	fbe3433edd	Use escape terminology	2020-06-21 11:43:08 -04:00
Brown	07adecc6eb	Use correct method id when creating taints	2020-06-21 02:06:08 -04:00
Brown	dc83c2e2fc	Add annotation for taint sources	2020-06-21 00:58:56 -04:00
Brown	f21d3a8346	Remove html and sql taints for simple preg_replace patterns	2020-06-20 23:11:42 -04:00
Brown	8edee96d8d	Fix taint regression	2020-06-20 18:10:01 -04:00
Brown	80ed1daf33	Allow static method mixin to invoke instance method	2020-06-20 18:05:35 -04:00
Brown	2c5c9e95e1	Don’t add two @return docblocks after @method	2020-06-20 15:30:47 -04:00
Brown	edbeec2c6a	Fix @method annotation namespacing	2020-06-20 15:18:22 -04:00
Ilija Tovilo	2f646d29db	Fix #3607 - constant string class reference with leading backslash (#3612)	2020-06-19 18:02:39 -04:00
Andrei Petre	6024fe4761	use original case in error messages when reporting undefined methods (#3615)	2020-06-19 11:51:08 -04:00
Brown	b1c836e5f3	Improve specialisation after call	2020-06-19 01:59:45 -04:00
Brown	8f2e28c36b	Improve tainting of specializable classes	2020-06-19 01:22:51 -04:00
Brown	078b8b7b1a	Fix #3618 - add way to load non-analyzed files	2020-06-19 00:13:09 -04:00
Brown	eecdc43ce7	Remove stray commas	2020-06-18 20:15:38 -04:00
Brown	49f0592794	Improve tracking of array taints	2020-06-18 18:48:19 -04:00
Brown	562a7c1ca4	Track taints from all tainted arrays	2020-06-18 13:45:58 -04:00
Brown	7d9a99a956	Fix #3609 - interpret strings as regular static calls	2020-06-18 11:56:08 -04:00
Brown	f609a01497	Move static property fetch analyzer to own class	2020-06-18 11:53:24 -04:00