AppFrameworkTainter.php 2.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960
  1. <?php
  2. /**
  3. * Copyright (c) 2020 Lukas Reschke <lukas@statuscode.ch>
  4. *
  5. * Permission is hereby granted, free of charge, to any person obtaining a copy
  6. * of this software and associated documentation files (the "Software"), to deal
  7. * in the Software without restriction, including without limitation the rights
  8. * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  9. * copies of the Software, and to permit persons to whom the Software is
  10. * furnished to do so, subject to the following conditions:
  11. *
  12. *
  13. * The above copyright notice and this permission notice shall be included in all
  14. * copies or substantial portions of the Software.
  15. *
  16. * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17. * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18. * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  19. * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20. * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21. * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  22. * SOFTWARE.
  23. */
  24. use Psalm\CodeLocation;
  25. use Psalm\Plugin\Hook\AfterFunctionLikeAnalysisInterface;
  26. use Psalm\Type\TaintKindGroup;
  27. class AppFrameworkTainter implements AfterFunctionLikeAnalysisInterface {
  28. public static function afterStatementAnalysis(
  29. PhpParser\Node\FunctionLike $stmt,
  30. Psalm\Storage\FunctionLikeStorage $classlike_storage,
  31. Psalm\StatementsSource $statements_source,
  32. Psalm\Codebase $codebase,
  33. array &$file_replacements = []
  34. ): ?bool {
  35. if ($statements_source->getFQCLN() !== null) {
  36. if ($codebase->classExtendsOrImplements($statements_source->getFQCLN(), \OCP\AppFramework\Controller::class)) {
  37. if ($stmt instanceof PhpParser\Node\Stmt\ClassMethod) {
  38. if ($stmt->isPublic() && !$stmt->isMagic()) {
  39. foreach ($stmt->params as $i => $param) {
  40. $expr_type = new Psalm\Type\Union([new Psalm\Type\Atomic\TString()]);
  41. $expr_identifier = (strtolower($statements_source->getFQCLN()) . '::' . strtolower($classlike_storage->cased_name) . '#' . ($i + 1));
  42. if ($expr_type) {
  43. $codebase->addTaintSource(
  44. $expr_type,
  45. $expr_identifier,
  46. TaintKindGroup::ALL_INPUT,
  47. new CodeLocation($statements_source, $param)
  48. );
  49. }
  50. }
  51. }
  52. }
  53. }
  54. }
  55. return null;
  56. }
  57. }