Open ohader opened 3 years ago
I found these snippets:
Alright... gave it some more thoughts...
input
is mapped to basically all specific types, except system_secret
and user_secret
@psalm-taint-sink system_secret $value
did not work, since $_GET
is just marked as input
source (and expanded to specific types mentioned above)system_secret
and user_secret
to input
would trigger lots of new code issue errors - in most cases false-positives → it's a bad ideapsalm-taint-source <taint-type | conditional>
(yay, more conditionals)
/**
* @psalm-taint-source ($value is-source input ? 'system_secret' : null)
*/
function signature(string $value, string $pepper = ''): string {}
$value
is some input
source system_secret
source$value is-source input
condition is a new domain-specific scope,$value is true
https://psalm.dev/r/adf4fa4aea
It seems
system_secret
anduser_secret
currently can only be used as@psalm-taint-source
- assigning@psalm-taint-sink system_secret
seems to be ignored.