Taint detection for $_SERVER?

vimeo / psalm

A static analysis tool for finding errors in PHP applications

https://psalm.dev

MIT License

5.57k stars 660 forks source link

Open TysonAndre opened 4 years ago

TysonAndre commented 4 years ago

Whitelist known good keys such as REQUEST_TIME* and SERVER_PROTOCOL and SCRIPT_FILENAME
$_SERVER['HTTP_X_Y'] is based on X-Y headers.
Some fields like QUERY_STRING can be set to almost any value by curl, but may be url escaped in some browsers

psalm-github-bot[bot] commented 4 years ago

Hey @TysonAndre, can you reproduce the issue on https://psalm.dev ?