232 Commits

Author	SHA1	Message	Date
Brown	b84cf74754	Fix #3668 - taint property types for magic properties without @property	2020-06-25 00:24:37 -04:00
Brown	dd25b81d3a	Fix #3670 - taint mixed foreach access	2020-06-24 19:16:30 -04:00
Brown	f72b609d42	Fix #3642 - detect missing property when name matches	2020-06-23 13:12:46 -04:00
Brown	7f05b3c530	Add $_REQUEST as a taint source ... Ref #3636	2020-06-22 17:16:15 -04:00
Brown	8f2e28c36b	Improve tainting of specializable classes	2020-06-19 01:22:51 -04:00
Brown	49f0592794	Improve tracking of array taints	2020-06-18 18:48:19 -04:00
Brown	562a7c1ca4	Track taints from all tainted arrays	2020-06-18 13:45:58 -04:00
Brown	7d9a99a956	Fix #3609 - interpret strings as regular static calls	2020-06-18 11:56:08 -04:00
Brown	f609a01497	Move static property fetch analyzer to own class	2020-06-18 11:53:24 -04:00
Brown	db67be5965	Fix #3483 - analyse variable static property access properly	2020-05-29 09:28:34 -04:00
Brown	0ef00f5756	Fix #3460 - allow isset checks on static properties	2020-05-26 17:40:27 -04:00
Brown	953be61cf2	Allow limiting connected taint paths	2020-05-25 23:28:11 -04:00
Brown	7e7456c863	Make taint checks more thorough	2020-05-25 17:10:53 -04:00
Brown	118b700436	Simplify sink mapping for internal calls	2020-05-25 13:10:06 -04:00
Brown	3416e33348	Fix indentation	2020-05-25 01:23:28 -04:00
Brown	240b2f898c	Add some negative test cases for @mixin ... Also fix #3452	2020-05-25 00:19:52 -04:00
Matthew Brown	1d17c02fba	Fix #3442 - support broader type after initial array assignment	2020-05-23 23:23:50 -04:00
Brown	63c3678ae5	Improve property location resolution	2020-05-22 12:33:38 -04:00
Matthew Brown	187b944680	Add faster taint analysis	2020-05-22 12:33:29 -04:00
Brown	0b2da18f1e	Break up StatementsAnalyzer	2020-05-19 12:56:30 -04:00
Brown	5ee1487a01	Make ExpressionAnalyzer more beautiful	2020-05-18 15:13:27 -04:00
Brown	c212c03e40	Don’t stop analysing when encountering an UndefinedGlobalVariable ... Fixes #3366	2020-05-14 22:51:51 -04:00
Brown	2af0a17d03	Fix #3236 - allow use-checking of more methods starting with __	2020-05-12 22:39:26 -04:00
Brown	8f2f2617d4	Improve refactor	2020-05-10 22:45:01 -04:00
Brown	5f4d162dd5	Break out type expander into separate class	2020-05-10 22:39:18 -04:00
Brown	48da7a4be8	Fix issues found with Vimeo’s code	2020-05-10 21:09:48 -04:00
Brown	28349c6423	Remove mixin_fqcln hack	2020-05-10 09:04:30 -04:00
Brown	bf5e178d16	Fix #3289 - treat property on non-generic type like actual value	2020-05-02 23:37:59 -04:00
Brown	d2d795018f	Fix #3138 - fix inherited property template type inference	2020-04-18 16:57:13 -04:00
Brown	73f8f963fa	Expand out class constants as early as possible ... Fixes #3128	2020-04-12 20:38:36 -04:00
Brown	9d2957d339	Fix a few more edge-cases	2020-04-12 01:26:11 -04:00
Brown	db7447abd7	Make array coercion-to--mixed rules a little more lenient	2020-04-10 16:21:48 -04:00
Brown	3a4dd70403	Prevent MixedMethodCall from generated array offsetGet calls	2020-04-09 11:45:15 -04:00
Brown	bd92ec6cd3	Detect nested issues	2020-04-09 10:42:54 -04:00
Brown	bd2104c5ba	Merge with mixed in nested arrays	2020-04-09 09:27:21 -04:00
Brown	d868710b2b	Fix handling of built arrays	2020-04-08 16:11:11 -04:00
Brown	067104e170	Fix #3084 - keep track of upper and lower bounds of inferred template types	2020-04-07 00:13:56 -04:00
Brown	fca6585f6e	Be more lenient when inside isset	2020-04-04 11:15:13 -04:00
Matthew Brown	7fdccc0439	Fix #3014 - change constant class access rules	2020-03-29 09:47:29 -04:00
Matthew Brown	de6aee32d1	Fix #3035 - improve templating for property assignments	2020-03-28 17:18:21 -04:00
Matthew Brown	47c1470e3b	Refactor reference checks to use more appropriate properties	2020-03-28 16:30:56 -04:00
Brown	cc548a45fa	Improve detection of unused classes	2020-03-28 14:45:58 -04:00
Brown	971ae50bea	Do prep work for #3024 - improve handling of absent class references	2020-03-26 12:35:27 -04:00
Brown	a9b6c51748	Improve new $class to make it more static-y	2020-03-24 18:30:08 -04:00
Matthew Brown	c986cdf12e	Allow edge-case of by-reference assignment with unitiliazed property ... Fixes #3003	2020-03-21 19:23:32 -04:00
Matthew Brown	bfb919d26a	Break out methods into their own classes	2020-03-11 23:04:52 -04:00
Brown	a0da7356e9	Fix #2935 - make handling of templated properties much less hacky	2020-03-09 09:59:02 -04:00
Matthew Brown	51bfc7c619	Only emit mixed issues for MissingClassPropertyType ... Fixes #2388	2020-03-06 07:57:00 -05:00
Matthew Brown	88c4088bc2	Prevent self/static refs outside classes ... Fixes #2895	2020-03-01 17:25:55 -05:00
Matthew Brown	1abece4f7c	Use more accurate types	2020-02-23 17:03:27 -05:00