Open ohader opened 2 years ago
I found these snippets:
Stubs might use a new @psalm-taint-guard html $value (or ..-reset or ..-assert - not sure about the naming yet).
Or @psalm-taint-remove
, -validate
, -throw
. I like -assert
since it's analogous to other assertions, but in that case it's a bit confusing because @psalm-taint-assert html
would assert that the variable isn't tainted with html. -remove
is also a bit confusing because from the name it seems like it removes the taint, when really it's just verifying that there was no taint. I suppose -guard
seems the best unless someone can come up with something better. We definitely need to make sure users are aware that the function is supposed to throw instead of returning a bool (and preferable find a name that still works with -if-true
tacked on the way @psalm-assert-if-true
works). Maybe something like @psalm-assert-untainted
, although it doesn't have the @psalm-taint
prefix like the rest of the tags?
This works for now, but I'm guessing you already know that.
I found these snippets:
https://psalm.dev/r/97bae91b9c
The example above would throw an exception if
<script>// some code</script>
would be assigned to$value
, but continue as expected in case justsome-plaint-text
would be given.The taint flow graph does not recognize this assertion and still reports the mentioned source code example as tainted. In order to avoid false-positives, the graph needs to be updated and the tainted flag cleared for
$value
onceassertProperEncoding($value)
has been called.Stubs might use a new
@psalm-taint-guard html $value
(or..-reset
or..-assert
- not sure about the naming yet).