Merge pull request #6537 from mmcev106/master

Prevent unnecessary filter_var() warnings on primitive types
vimeo · Sep 27, 2021 · ef82910 · ef82910
2 parents b29737f + 79340b4
commit ef82910
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 1 deletion.
diff --git a/stubs/CoreGenericFunctions.phpstub b/stubs/CoreGenericFunctions.phpstub
@@ -665,6 +665,20 @@ function array_sum(array $input) {}
  */
 function array_product(array $input) {}
 
+/**
+ * 257 is FILTER_VALIDATE_INT
+ * @psalm-taint-escape ($filter is 257 ? 'html' : null)
+ *
+ * 258 is FILTER_VALIDATE_BOOLEAN
+ * @psalm-taint-escape ($filter is 258 ? 'html' : null)
+ *
+ * 259 is FILTER_VALIDATE_FLOAT
+ * @psalm-taint-escape ($filter is 259 ? 'html' : null)
+ *
+ * @psalm-flow ($value, $filter, $options) -> return
+ */
+function filter_var(mixed $value, int $filter = FILTER_DEFAULT, array|int $options = 0): mixed {}
+
 /**
  * @psalm-pure
  *

diff --git a/tests/TaintTest.php b/tests/TaintTest.php
@@ -233,6 +233,18 @@ function foo() : void {
                         echo $a;
                     }'
             ],
+            'taintFilterVarInt' => [
+                '<?php
+                    echo filter_var($_GET["bad"], FILTER_VALIDATE_INT);'
+            ],
+            'taintFilterVarBoolean' => [
+                '<?php
+                    echo filter_var($_GET["bad"], FILTER_VALIDATE_BOOLEAN);'
+            ],
+            'taintFilterVarFloat' => [
+                '<?php
+                    echo filter_var($_GET["bad"], FILTER_VALIDATE_FLOAT);'
+            ],
             'taintLdapEscape' => [
                 '<?php
                     $ds = ldap_connect(\'example.com\');
@@ -1619,7 +1631,7 @@ public function __set(string $a, $value) {
                     echo $get["test"];',
                 'error_message' => 'TaintedHtml',
             ],
-            'taintFilterVar' => [
+            'taintFilterVarCallback' => [
                 '<?php
                     $get = filter_var($_GET, FILTER_CALLBACK, ["options" => "trim"]);