danog/psalm
1
0
Fork 0
mirror of https://github.com/danog/psalm.git synced 2024-12-02 09:37:59 +01:00
Code Issues Projects Releases Wiki Activity
7,894 Commits 43 Branches 314 Tags 108 MiB
f8e22ab7ac
Commit Graph

3752 Commits

Author SHA1 Message Date
Matt Brown
56918001a8
Fix #4643 - use PHP8 union types when possible 2021-01-29 11:46:20 +01:00
Matt Brown
48a58c56e3
Don’t erase already-known literal ints 
Fixes #4644
 2021-01-29 11:46:20 +01:00
Matt Brown
48fba8a6b9
Only run unused code analysis where necessary 2021-01-29 11:46:20 +01:00
Matt Brown
d43bb3923b
Break aparat type combiner 2021-01-29 11:46:20 +01:00
Lukas Reschke
b2143f1da5
Implement variadic taint propagation (#4649) 
* Implement variadic taint propagation

* Lint code
 2021-01-29 11:46:19 +01:00
orklah
58ddeaafdf
use int|string in phpdoc format for array-key (#4645) 2021-01-29 11:46:19 +01:00
Lukas Reschke
4de2bf8f7f
Add psalm-flow for string functions from sscanf to wordwrap (#4591) 
* Add string functions from sscanf to wordwrap

This should conclude all string functions from https://www.php.net/manual/en/book.strings.php

Continuation of https://github.com/vimeo/psalm/pull/4576

Ref https://github.com/vimeo/psalm/issues/3636

* Add StrTrReturnTypeProvider

* Fix psalm error

* phpcs

* Line length

* Ignore false return on vsprintf

Co-authored-by: Matthew Brown <github@muglug.com>
 2021-01-29 11:46:19 +01:00
Matt Brown
38d1dded4e
Fix test 2021-01-29 11:46:19 +01:00
Matt Brown
b539fdf70e
Allow Psalm to run in taint analysis mode without a config 2021-01-29 11:46:18 +01:00
orklah
289a3b220b
allow static return type in PHP8 (#4641) 2021-01-29 11:46:18 +01:00
Matt Brown
068907327d
Fix #4637 - prevent regression when negating function call with === false 2021-01-29 11:46:18 +01:00
Dalibor Karlović
ea089d9696
feature: allow plugin manager to work without config file (#4639) 2021-01-29 11:46:17 +01:00
orklah
5afbf5f831
return static instead of self when static context detected (#4632) 
* return this instead of self when static context detected

* replace $this by static
 2021-01-29 11:46:17 +01:00
Matt Brown
02b1cc2288
Change TaintedText to TaintedCallable 2021-01-29 11:46:17 +01:00
Lukas Reschke
2ad5eee193
Add dedicated types for 'file', 'header' and 'cookie' (#4630) 
* [WIP] Add dedicated sinks for 'file', 'header' and 'cookie'

* Add documentation

* Add mapping for taint flows

* Add tests

* Fix test
 2021-01-29 11:46:16 +01:00
Matt Brown
3b3239635b
Fix #4626 - array_key_exists should infer type for first arg where possible 2021-01-29 11:46:16 +01:00
Matt Brown
7b4f0745f5
Simplify assertion negations, centralising as much as possible 
Now the flag passed to scrapeAssertions just determines the errors emitted
 2021-01-29 11:46:16 +01:00
Matt Brown
6f9be03789
Revert "Fix #4624 - allow in_array to work with list arrays" 
This reverts commit 08ae85a735.
 2021-01-29 11:46:16 +01:00
Matt Brown
191f305aec
Fix #4624 - allow in_array to work with list arrays 2021-01-29 11:46:15 +01:00
Matt Brown
43187a0e19
Fix #4620 - reconciled literal strings cannot carry taints 2021-01-29 11:46:15 +01:00
Matt Brown
005f394d8e
Allow immutable classes to be specialised through calls 2021-01-29 11:46:15 +01:00
Matt Brown
c3658e2590
Fix #4605 - taint parent-declared property 2021-01-29 11:46:15 +01:00
Lukas Reschke
ce05165384
Split LDAP into custom category (#4604) 
- Adds ldap_escape as sanitizer
- Defines the right parameters to ldap_search as sink
- Wrote documentation
- Added tests
 2021-01-29 11:46:14 +01:00
Matt Brown
3b8a76d520
Fix #4599 - propagate taints to parent callers where necessary 2021-01-29 11:46:14 +01:00
Lukas Reschke
99d094b5e0
Add SSRF sinks (#4592) 2021-01-29 11:46:14 +01:00
Matt Brown
3484976686
Sanity check to ensure closure uses aren’t removed 2021-01-29 11:46:14 +01:00
Matt Brown
5246841b12
Fix tests 2021-01-29 11:46:14 +01:00
Matt Brown
a4b56c9292
Simplify tainted output a bit, removing duplicate paths 2021-01-29 11:46:13 +01:00
Matt Brown
a7cc439db0
Don’t propagate taints to child constructor args 2021-01-29 11:46:13 +01:00
Matt Brown
0b14b6968e
Fix #4472 - if something flows into a byref var it’s used 2021-01-29 11:46:13 +01:00
Lukas Reschke
c42927c6e4
Add SARIF as report output (#4582) 
https://docs.oasis-open.org/sarif/sarif/v2.0/sarif-v2.0.html
 2021-01-29 11:46:13 +01:00
Matt Brown
2c69618347
Break out TaintedInput issues into a lot of separate ones 2021-01-29 11:46:13 +01:00
Dusk
4e7bd1e39b
Allow named arguments to variadic functions (#4575) 
Closes #4563
 2021-01-29 11:46:11 +01:00
Lukas Reschke
ff55dba130
Add sinks for popen and proc_open (#4572) 
User input in those two functions could lead to a RCE.

popen: https://www.php.net/manual/en/function.popen.php
proc_open: https://www.php.net/manual/en/function.proc-open.php
 2021-01-29 11:46:11 +01:00
orklah
2f368244a4
Detect trying to access to a list with a negative offset (#4552) 2021-01-29 11:46:11 +01:00
Matt Brown
4fff920952
Fix #4529 - allow unsetting with complex array key 2021-01-29 11:46:10 +01:00
Matt Brown
4a8c98257e
Add closure-use termination for byref flows 2021-01-29 11:46:10 +01:00
Matt Brown
ad840e4b7a
Fix #4547 - mark unused uses 2021-01-29 11:46:10 +01:00
Matt Brown
c1d57ba6a5
Uses by ref should be assigned that way 2021-01-29 11:46:10 +01:00
Matt Brown
5f01ea788a
Fix #4544 - improve handling of get_class in match 2021-01-29 11:46:10 +01:00
Matt Brown
5219932408
Fix #4545 - allow intersections in more places 2021-01-29 11:46:10 +01:00
Matt Brown
63bf00513b
Split out trait template tests 2021-01-29 11:46:09 +01:00
Matt Brown
8392fb429c
Fix #4540 - use correct method when simulating property setting 2021-01-29 11:46:09 +01:00
Matt Brown
e8c755c7c0
Fix #4537 - use more rigorous inerhitance for return and param types 2021-01-29 11:46:09 +01:00
Matt Brown
bd20313a14
Use better way to determine which signture to use 
Fixes #4524
 2021-01-29 11:46:09 +01:00
Matt Brown
fb5ee1e46d
Bind lower bounds to upper bounds as well when no upper bound can be inferred 
Ref #4485
 2021-01-29 11:46:08 +01:00
Matt Brown
e624f972dd
Fix #4524 - do better template param inheritance 2021-01-29 11:46:08 +01:00
Matt Brown
f3b6846c70
Fix #4527 - improve interpolated string types 2021-01-29 11:46:08 +01:00
Adrien LUCAS
9ab0ab9472
Add a proxy capability to the flow annotation (#4495) 
* Add a `passthru` capability to the flow annotation

* Fix passthru-calls type

* Fix types and rename to proxy

* Allow to proxy a method

Co-authored-by: Matthew Brown <github@muglug.com>
 2021-01-29 11:46:07 +01:00
Matt Brown
d07a8bb4a5
Add descendant variables for closure uses 
Fixes #4522
 2021-01-29 11:46:07 +01:00
Matt Brown
1ad65fb899
Fix #4517 - track type contradiction issues in match expressions 2021-01-29 11:46:07 +01:00
Matt Brown
9fd4a24c55
Fix #4516 - treat exit() as the empty type 2021-01-29 11:46:07 +01:00
Matt Brown
ec9d8e6700
Fix #4519 - prevent crash with empty match 2021-01-29 11:46:07 +01:00
Matt Brown
e2eee4cb46
Break apart complex method 2021-01-29 11:46:07 +01:00
Matt Brown
fbafb9e97f
Fix #4509 - treat expression-derived constants as mixed 2021-01-29 11:46:06 +01:00
Matt Brown
36af6d70d2
Fix tests 2021-01-29 11:46:05 +01:00
Matt Brown
b68995582e
Preserve reconciled taints for all but non-string scalar types 2021-01-29 11:46:05 +01:00
Matt Brown
fb5e30850a
Fix #4503 - don’t ignore assertions on possibly-null mixed 2021-01-29 11:46:05 +01:00
Matt Brown
64ade75d13
Get rid of version test, which is dumb 2021-01-29 11:46:04 +01:00
Axel H
2f10ad0c24
Fix type inference when unpacking typed iterables (#4487) 
* Add test for unpacking typed iterables

* Fix type inference when unpacking typed iterables into arrays

* Fix possibly undefined array offset
 2021-01-29 11:46:04 +01:00
Matt Brown
578e65820a
Ensure we flush out re-assigned vars also referenced 
Fixes #4488
 2021-01-29 11:46:04 +01:00
Matt Brown
57cd29ee9d
Put assignment-in-conditional tests in their own file 2021-01-29 11:46:04 +01:00
Matt Brown
1389dc6adf
Allow opt-in to strict return type checking 2021-01-29 11:46:03 +01:00
Matt Brown
3483c59d9b
Fix #4479 - use correct keys in message 2021-01-29 11:46:03 +01:00
Matt Brown
d688d5fd74
Add support for @return never 2021-01-29 11:45:02 +01:00
Matt Brown
8b44459c7c
Fix overeager inference 2021-01-29 11:45:02 +01:00
Matt Brown
d4846b14e6
Reorganise things a little 2021-01-29 11:45:02 +01:00
Matt Brown
e3a352d287
Fix int-mask-of expansion 2021-01-29 11:45:02 +01:00
Matt Brown
2a7feef5f6
Fix #4466 use better differentiation for class_exists second param 2021-01-29 11:45:01 +01:00
Matt Brown
c07378a713
Fix #4467 - variables are only the same if they were set in the same location 2021-01-29 11:45:01 +01:00
Matt Brown
badf0855ce
Invalidate child methods when signature changes 2021-01-29 11:45:01 +01:00
Matt Brown
9d35e3c251
Fix #4464 - bust cache when Psalm’s version changes, not just composer’s 2021-01-29 11:45:01 +01:00
Matt Brown
b217916f37
Use better inference for getAttributes return type 
Fixes #4367
 2021-01-29 11:45:00 +01:00
Matt Brown
0ea0604cf3
Fix #4453 - sanitise @extends types before attempting to parse 2021-01-29 11:44:36 +01:00
Matt Brown
881068d5c0
Detect when targets are incorrectly targeted 2021-01-29 11:44:36 +01:00
Matt Brown
98b755fb6c
Add support for int-mask<...> and int-mask-of<...> 2021-01-29 11:44:35 +01:00
Matt Brown
fb81fa13f4
Ensure Stringable is always available to tests that need it 2021-01-29 11:44:35 +01:00
Matt Brown
9f87b99fac
Fix #4435 - ensure casts are always flow-sensitive 2021-01-29 11:44:35 +01:00
Matt Brown
ab90097baf
Remove subpar test 2021-01-29 11:44:35 +01:00
Matt Brown
3ebdb3b952
Use more accurate comparison for non-empty-lists 2021-01-29 11:44:34 +01:00
Matt Brown
951c3715f7
Fix tests 2021-01-29 11:44:33 +01:00
Matt Brown
35fd64bf74
Fix test type 2021-01-29 11:44:33 +01:00
Matt Brown
106747487b
Fix #4429 - any class with a __toString method in PHP8 assumed to implement Stringable 2021-01-29 11:44:33 +01:00
Matt Brown
7f975045f4
Fix #4422 - be aware of nested template params 2021-01-29 11:44:33 +01:00
Matt Brown
e440baf671
Improve algebra handling a little better 2021-01-29 11:44:33 +01:00
Matt Brown
870d07ba51
Fix #4418 - improve try analysis for mixed, too 2021-01-29 11:44:32 +01:00
Matt Brown
c16d779bca
Fix #4397 - allow offsetGet on inside isset 2021-01-29 11:44:32 +01:00
Matt Brown
e8b3f55013
Track final-ness of class when evaluating trait returns 2021-01-29 11:44:31 +01:00
Matt Brown
5aee8e77d5
Fix #4414 - allow multiple @psalm-assert-if-true on same var 2021-01-29 11:44:31 +01:00
Matt Brown
eef4ea018b
Empty checks variables are really falsy checks 2021-01-29 11:44:31 +01:00
Matt Brown
a57d62b71b
Add logic to weed out unnecessary clauses 2021-01-29 11:44:30 +01:00
Matt Brown
3ff2116c17
Add basic support for PHP attributes 
Ref #4367 - supports creation and argument checks
 2021-01-29 11:44:30 +01:00
Matt Brown
e90b595b92
Break apart ReflectorVisitor 2021-01-29 11:44:29 +01:00
Matt Brown
67859ed19b
Invalidate signature types when use changes 2021-01-29 11:41:13 +01:00
Matt Brown
3731255f6f
Fix #4386 - fix issues with property promotion 2021-01-29 11:41:13 +01:00
feek
d1b7cf6860
feature: ensure universal object crate class exists (#4375) 2021-01-29 11:41:13 +01:00
Matt Brown
7df404bfb5
Fix #4374 - prevent paradox and allow Psalm to understand more assignments in conditionals 2021-01-29 11:41:13 +01:00
Matt Brown
26352d0e39
Fix #3625 - getIterator call is used inside loop 2021-01-29 11:41:12 +01:00
Matt Brown
d7a0b718ec
Fix #4372 - count implicitly-used short-closure vars as used 2021-01-29 11:41:12 +01:00
Matt Brown
b3e423fd03
Fix #4368 - improve handling of try with finally 2021-01-29 11:41:12 +01:00