Add a bit more accuracy

vimeo · Jun 25, 2020 · b8ebed0 · b8ebed0
1 parent e269220
commit b8ebed0
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 1 deletion.
diff --git a/src/Psalm/Internal/Codebase/Taint.php b/src/Psalm/Internal/Codebase/Taint.php
@@ -245,11 +245,16 @@ private function getChildNodes(
                         $fetch_nesting--;
                     }
 
-                    if ($previous_path_type === 'array-fetch') {
+                    if (substr($previous_path_type, 0, 11) === 'array-fetch') {
                         $fetch_nesting++;
                     }
 
                     if (strpos($previous_path_type, 'array-assignment-') === 0) {
+                        if ($fetch_nesting > 0) {
+                            $fetch_nesting--;
+                            continue;
+                        }
+
                         if (substr($previous_path_type, 17) === substr($path_type, 12)) {
                             break;
                         }

diff --git a/tests/TaintTest.php b/tests/TaintTest.php
@@ -427,6 +427,13 @@ public static function slugify(string $url) : string {
                         echo $m["b"];
                     }'
             ],
+            'taintFreeNestedArrayWithOffsetAccessedExplicitly' => [
+                '<?php
+                    $a = [];
+                    $a[] = ["a" => $_GET["name"], "b" => "foo"];
+
+                    echo $a[0]["b"];',
+            ],
         ];
     }
 
@@ -1267,6 +1274,24 @@ public function __set(string $a, $value) {
                     echo $m->taint;',
                 'error_message' => 'TaintedInput',
             ],
+            'taintNestedArrayWithOffsetAccessedInForeach' => [
+                '<?php
+                    $a = [];
+                    $a[0] = ["a" => $_GET["name"], "b" => "foo"];
+
+                    foreach ($a as $m) {
+                        echo $m["a"];
+                    }',
+                'error_message' => 'TaintedInput',
+            ],
+            'taintNestedArrayWithOffsetAccessedExplicitly' => [
+                '<?php
+                    $a = [];
+                    $a[] = ["a" => $_GET["name"], "b" => "foo"];
+
+                    echo $a[0]["a"];',
+                'error_message' => 'TaintedInput',
+            ],
         ];
     }
 }