Skip to content

Commit d86de9d

Browse files
isublimityisublimity
authored
Merge pull request #282 from danog/psalm-taint-annotations
Add Psalm taint analysis annotations
2 parents fcf247d + 24da49d commit d86de9d

4 files changed

Lines changed: 73 additions & 0 deletions

File tree

‎src/Client.php‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,8 @@ public function getSession(): string|false
254254

255255
/**
256256
* Query CREATE/DROP
257+
*
258+
* @psalm-taint-sink sql $sql
257259
*/
258260
public function write(string $sql, array $bindings = [], bool $exception = true, array $querySettings = []): Statement
259261
{
@@ -310,6 +312,9 @@ public function enableExtremes(bool $flag = true): static
310312
return $this;
311313
}
312314

315+
/**
316+
* @psalm-taint-sink sql $sql
317+
*/
313318
public function select(
314319
string $sql,
315320
array $bindings = [],
@@ -356,6 +361,8 @@ public function progressFunction(callable $callback): void
356361

357362
/**
358363
* prepare select
364+
*
365+
* @psalm-taint-sink sql $sql
359366
*/
360367
public function selectAsync(
361368
string $sql,
@@ -377,6 +384,8 @@ public function selectAsync(
377384
* @param string $sql SQL with {name:Type} placeholders, e.g. 'SELECT * FROM t WHERE id = {id:UInt32}'
378385
* @param array<string, mixed> $params Parameter values, e.g. ['id' => 42]
379386
* @param array $querySettings Per-query settings override
387+
*
388+
* @psalm-taint-sink sql $sql
380389
*/
381390
public function selectWithParams(string $sql, array $params, array $querySettings = []): Statement
382391
{
@@ -390,6 +399,8 @@ public function selectWithParams(string $sql, array $params, array $querySetting
390399
* @param array<string, mixed> $params Parameter values
391400
* @param bool $exception Throw on error
392401
* @param array $querySettings Per-query settings override
402+
*
403+
* @psalm-taint-sink sql $sql
393404
*/
394405
public function writeWithParams(string $sql, array $params, bool $exception = true, array $querySettings = []): Statement
395406
{
@@ -406,6 +417,8 @@ public function writeWithParams(string $sql, array $params, bool $exception = tr
406417
* @param string $sql SQL with {name:Type} placeholders, e.g. 'SELECT * FROM t WHERE id = {id:UInt32} FORMAT JSONEachRow'
407418
* @param array<string, mixed> $params Parameter values, e.g. ['id' => 42]
408419
* @param array $querySettings Per-query settings override
420+
*
421+
* @psalm-taint-sink sql $sql
409422
*/
410423
public function readWithParams(Stream $streamRead, string $sql, array $params, array $querySettings = []): Statement
411424
{
@@ -421,6 +434,8 @@ public function readWithParams(Stream $streamRead, string $sql, array $params, a
421434
*
422435
* @param array $querySettings Per-query settings override
423436
* @return \Generator yields associative arrays, one per row
437+
*
438+
* @psalm-taint-sink sql $sql
424439
*/
425440
public function selectGenerator(string $sql, array $bindings = [], array $querySettings = []): \Generator
426441
{
@@ -463,6 +478,8 @@ public function showDatabases(): array
463478

464479
/**
465480
* statement = SHOW CREATE TABLE
481+
*
482+
* @psalm-taint-sink sql $table
466483
*/
467484
public function showCreateTable(string $table): mixed
468485
{
@@ -489,6 +506,9 @@ public function getCountPendingQueue(): int
489506
* @param mixed[][] $values
490507
* @param string[] $columns
491508
* @throws Exception\TransportException
509+
*
510+
* @psalm-taint-sink sql $table
511+
* @psalm-taint-sink sql $columns
492512
*/
493513
public function insert(string $table, array $values, array $columns = []): Statement
494514
{
@@ -555,6 +575,8 @@ public function prepareInsertAssocBulk(array $values): array
555575
*
556576
* @param string $tableName - name table
557577
* @param mixed[] $values - array column_name => value (if we insert one row) or array list column_name => value if we insert many lines
578+
*
579+
* @psalm-taint-sink sql $tableName
558580
*/
559581
public function insertAssocBulk(string $tableName, array $values): Statement
560582
{
@@ -568,6 +590,10 @@ public function insertAssocBulk(string $tableName, array $values): Statement
568590
*
569591
* @param string|string[] $fileNames
570592
* @param string[] $columns
593+
*
594+
* @psalm-taint-sink sql $tableName
595+
* @psalm-taint-sink sql $columns
596+
* @psalm-taint-sink file $fileNames
571597
*/
572598
public function insertBatchTSVFiles(string $tableName, $fileNames, array $columns = []): array
573599
{
@@ -582,6 +608,11 @@ public function insertBatchTSVFiles(string $tableName, $fileNames, array $column
582608
* @param string $format ['TabSeparated','TabSeparatedWithNames','CSV','CSVWithNames']
583609
* @return Statement[]
584610
* @throws Exception\TransportException
611+
*
612+
* @psalm-taint-sink sql $tableName
613+
* @psalm-taint-sink sql $columns
614+
* @psalm-taint-sink sql $format
615+
* @psalm-taint-sink file $fileNames
585616
*/
586617
public function insertBatchFiles(string $tableName, $fileNames, array $columns = [], string $format = 'CSV'): array
587618
{
@@ -631,6 +662,10 @@ public function insertBatchFiles(string $tableName, $fileNames, array $columns =
631662
*
632663
* @param string[] $columns
633664
* @param string $format ['TabSeparated','TabSeparatedWithNames','CSV','CSVWithNames']
665+
*
666+
* @psalm-taint-sink sql $tableName
667+
* @psalm-taint-sink sql $columns
668+
* @psalm-taint-sink sql $format
634669
*/
635670
public function insertBatchStream(string $tableName, array $columns = [], string $format = 'CSV'): Transport\CurlerRequest
636671
{
@@ -656,6 +691,8 @@ public function insertBatchStream(string $tableName, array $columns = [], string
656691
*
657692
* @param array<string, mixed> $bind
658693
* @throws Exception\TransportException
694+
*
695+
* @psalm-taint-sink sql $sql
659696
*/
660697
public function streamWrite(Stream $stream, string $sql, array $bind = []): Statement
661698
{
@@ -670,6 +707,8 @@ public function streamWrite(Stream $stream, string $sql, array $bind = []): Stat
670707
* stream Read
671708
*
672709
* @param array<string, mixed> $bind
710+
*
711+
* @psalm-taint-sink sql $sql
673712
*/
674713
public function streamRead(Stream $streamRead, string $sql, array $bind = []): Statement
675714
{
@@ -769,6 +808,9 @@ public function tablesSize(bool $flatList = false): array
769808
* isExists
770809
*
771810
* @throws \Exception
811+
*
812+
* @psalm-taint-sink sql $database
813+
* @psalm-taint-sink sql $table
772814
*/
773815
public function isExists(string $database, string $table): array
774816
{
@@ -808,6 +850,8 @@ public function partitions(string $table, int $limit = 0, ?bool $active = null):
808850
/**
809851
* dropPartition
810852
* @deprecated
853+
*
854+
* @psalm-taint-sink sql $dataBaseTableName
811855
*/
812856
public function dropPartition(string $dataBaseTableName, string $partition_id): Statement
813857
{
@@ -827,6 +871,8 @@ public function dropPartition(string $dataBaseTableName, string $partition_id):
827871
* Truncate ( drop all partitions )
828872
* @throws \Exception
829873
* @deprecated
874+
*
875+
* @psalm-taint-sink sql $tableName
830876
*/
831877
public function truncateTable(string $tableName): array
832878
{

‎src/Query/WriteToFile.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ class WriteToFile
2222

2323
private bool $gzip = false;
2424

25+
/**
26+
* @psalm-taint-sink file $file_name
27+
*/
2528
public function __construct(string $file_name, bool $overwrite = true, ?string $format = null) {
2629

2730

‎src/Quote/FormatLine.php‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,33 @@ public static function strictQuote(string $format): StrictQuoteLine
1717
return self::$strict[$format];
1818
}
1919

20+
/**
21+
* @psalm-taint-specialize
22+
*
23+
* @psalm-flow ($row) -> return
24+
*
25+
* @psalm-taint-escape ($skipEncode is false ? 'sql' : null)
26+
*/
2027
public static function Insert(array $row, bool $skipEncode = false): string
2128
{
2229
return self::strictQuote('Insert')->quoteRow($row, $skipEncode);
2330
}
2431

32+
/**
33+
* @psalm-taint-specialize
34+
*
35+
* @psalm-flow ($row) -> return
36+
*/
2537
public static function TSV(array $row): string
2638
{
2739
return self::strictQuote('TSV')->quoteRow($row);
2840
}
2941

42+
/**
43+
* @psalm-taint-specialize
44+
*
45+
* @psalm-flow ($row) -> return
46+
*/
3047
public static function CSV(array $row): string
3148
{
3249
return self::strictQuote('CSV')->quoteRow($row);

‎src/Quote/ValueFormatter.php‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,13 @@
2222

2323
class ValueFormatter
2424
{
25+
/**
26+
* @psalm-taint-specialize
27+
*
28+
* @psalm-flow ($value) -> return
29+
*
30+
* @psalm-taint-escape ($addQuotes is true ? 'sql' : null)
31+
*/
2532
public static function formatValue(mixed $value, bool $addQuotes = true): mixed
2633
{
2734
if ($value instanceof DateTimeInterface) {

0 commit comments

Comments
 (0)