Skip to content

Commit

Permalink
Merge pull request #9170 from mmcev106/filter-var-pure
Browse files Browse the repository at this point in the history 
Added @psalm-pure to filter_var()
  • Loading branch information
@orklah
orklah committed Feb 2, 2023
2 parents a56e08d + 77ea545 commit 54cd529
Show file tree
Hide file tree
Showing 3 changed files with 88 additions and 14 deletions.
2 changes: 1 addition & 1 deletion src/Psalm/Internal/Analyzer/Statements/Expression/Call/FunctionCallReturnTypeFetcher.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -658,7 +658,7 @@ private static function taintReturnType(
$stmt->getArgs(),
$node_location,
$function_call_node,
$removed_taints,
array_merge($removed_taints, $conditionally_removed_taints),
$added_taints,
);
}
Expand Down
62 changes: 62 additions & 0 deletions stubs/CoreGenericFunctions.phpstub
View file
Original file line number Diff line number Diff line change
Expand Up @@ -813,20 +813,82 @@ function array_sum(array $array) {}
function array_product(array $array) {}

/**
* @psalm-pure
*
* 257 is FILTER_VALIDATE_INT
* @psalm-taint-escape ($filter is 257 ? 'callable' : null)
* @psalm-taint-escape ($filter is 257 ? 'unserialize' : null)
* @psalm-taint-escape ($filter is 257 ? 'include' : null)
* @psalm-taint-escape ($filter is 257 ? 'eval' : null)
* @psalm-taint-escape ($filter is 257 ? 'ldap' : null)
* @psalm-taint-escape ($filter is 257 ? 'sql' : null)
* @psalm-taint-escape ($filter is 257 ? 'html' : null)
* @psalm-taint-escape ($filter is 257 ? 'has_quotes' : null)
* @psalm-taint-escape ($filter is 257 ? 'shell' : null)
* @psalm-taint-escape ($filter is 257 ? 'ssrf' : null)
* @psalm-taint-escape ($filter is 257 ? 'file' : null)
* @psalm-taint-escape ($filter is 257 ? 'cookie' : null)
* @psalm-taint-escape ($filter is 257 ? 'header' : null)
*
* 258 is FILTER_VALIDATE_BOOLEAN
* @psalm-taint-escape ($filter is 258 ? 'callable' : null)
* @psalm-taint-escape ($filter is 258 ? 'unserialize' : null)
* @psalm-taint-escape ($filter is 258 ? 'include' : null)
* @psalm-taint-escape ($filter is 258 ? 'eval' : null)
* @psalm-taint-escape ($filter is 258 ? 'ldap' : null)
* @psalm-taint-escape ($filter is 258 ? 'sql' : null)
* @psalm-taint-escape ($filter is 258 ? 'html' : null)
* @psalm-taint-escape ($filter is 258 ? 'has_quotes' : null)
* @psalm-taint-escape ($filter is 258 ? 'shell' : null)
* @psalm-taint-escape ($filter is 258 ? 'ssrf' : null)
* @psalm-taint-escape ($filter is 258 ? 'file' : null)
* @psalm-taint-escape ($filter is 258 ? 'cookie' : null)
* @psalm-taint-escape ($filter is 258 ? 'header' : null)
*
* 259 is FILTER_VALIDATE_FLOAT
* @psalm-taint-escape ($filter is 259 ? 'callable' : null)
* @psalm-taint-escape ($filter is 259 ? 'unserialize' : null)
* @psalm-taint-escape ($filter is 259 ? 'include' : null)
* @psalm-taint-escape ($filter is 259 ? 'eval' : null)
* @psalm-taint-escape ($filter is 259 ? 'ldap' : null)
* @psalm-taint-escape ($filter is 259 ? 'sql' : null)
* @psalm-taint-escape ($filter is 259 ? 'html' : null)
* @psalm-taint-escape ($filter is 259 ? 'has_quotes' : null)
* @psalm-taint-escape ($filter is 259 ? 'shell' : null)
* @psalm-taint-escape ($filter is 259 ? 'ssrf' : null)
* @psalm-taint-escape ($filter is 259 ? 'file' : null)
* @psalm-taint-escape ($filter is 259 ? 'cookie' : null)
* @psalm-taint-escape ($filter is 259 ? 'header' : null)
*
* 519 is FILTER_SANITIZE_NUMBER_INT
* @psalm-taint-escape ($filter is 519 ? 'callable' : null)
* @psalm-taint-escape ($filter is 519 ? 'unserialize' : null)
* @psalm-taint-escape ($filter is 519 ? 'include' : null)
* @psalm-taint-escape ($filter is 519 ? 'eval' : null)
* @psalm-taint-escape ($filter is 519 ? 'ldap' : null)
* @psalm-taint-escape ($filter is 519 ? 'sql' : null)
* @psalm-taint-escape ($filter is 519 ? 'html' : null)
* @psalm-taint-escape ($filter is 519 ? 'has_quotes' : null)
* @psalm-taint-escape ($filter is 519 ? 'shell' : null)
* @psalm-taint-escape ($filter is 519 ? 'ssrf' : null)
* @psalm-taint-escape ($filter is 519 ? 'file' : null)
* @psalm-taint-escape ($filter is 519 ? 'cookie' : null)
* @psalm-taint-escape ($filter is 519 ? 'header' : null)
*
* 520 is FILTER_SANITIZE_NUMBER_FLOAT
* @psalm-taint-escape ($filter is 520 ? 'callable' : null)
* @psalm-taint-escape ($filter is 520 ? 'unserialize' : null)
* @psalm-taint-escape ($filter is 520 ? 'include' : null)
* @psalm-taint-escape ($filter is 520 ? 'eval' : null)
* @psalm-taint-escape ($filter is 520 ? 'ldap' : null)
* @psalm-taint-escape ($filter is 520 ? 'sql' : null)
* @psalm-taint-escape ($filter is 520 ? 'html' : null)
* @psalm-taint-escape ($filter is 520 ? 'has_quotes' : null)
* @psalm-taint-escape ($filter is 520 ? 'shell' : null)
* @psalm-taint-escape ($filter is 520 ? 'ssrf' : null)
* @psalm-taint-escape ($filter is 520 ? 'file' : null)
* @psalm-taint-escape ($filter is 520 ? 'cookie' : null)
* @psalm-taint-escape ($filter is 520 ? 'header' : null)
*
* @psalm-flow ($value, $filter, $options) -> return
*/
Expand Down
38 changes: 25 additions & 13 deletions tests/TaintTest.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -230,19 +230,31 @@ function foo() : void {
echo $a;
}',
],
'taintFilterVarInt' => [
'code' => '<?php
echo filter_var($_GET["bad"], FILTER_VALIDATE_INT);
echo filter_var($_GET["bad"], FILTER_SANITIZE_NUMBER_INT);',
],
'taintFilterVarBoolean' => [
'code' => '<?php
echo filter_var($_GET["bad"], FILTER_VALIDATE_BOOLEAN);',
],
'taintFilterVarFloat' => [
'code' => '<?php
echo filter_var($_GET["bad"], FILTER_VALIDATE_FLOAT);
echo filter_var($_GET["bad"], FILTER_SANITIZE_NUMBER_FLOAT);',
'taintFilterVar' => [
'code' => '<?php
$args = [
filter_var($_GET["bad"], FILTER_VALIDATE_INT),
filter_var($_GET["bad"], FILTER_VALIDATE_BOOLEAN),
filter_var($_GET["bad"], FILTER_VALIDATE_FLOAT),
filter_var($_GET["bad"], FILTER_SANITIZE_NUMBER_INT),
filter_var($_GET["bad"], FILTER_SANITIZE_NUMBER_FLOAT),
];
foreach($args as $arg){
new $arg;
unserialize($arg);
require_once $arg;
eval($arg);
ldap_connect($arg);
ldap_search("", "", $arg);
mysqli_query($conn, $arg);
echo $arg;
system($arg);
curl_init($arg);
file_get_contents($arg);
setcookie($arg);
header($arg);
}',
],
'taintLdapEscape' => [
'code' => '<?php
Expand Down

0 comments on commit 54cd529

Please sign in to comment.