#10117 New sinks for TaintedCallable

vimeo · Aug 22, 2023 · cab2379 · cab2379
1 parent 948dd1a
commit cab2379
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 1 deletion.
diff --git a/stubs/Reflection.phpstub b/stubs/Reflection.phpstub
@@ -14,6 +14,7 @@ class ReflectionClass implements Reflector {
 
     /**
      * @param T|class-string<T>|interface-string<T>|trait-string|enum-string<T> $argument
+     * @psalm-taint-sink callable $argument
      * @psalm-pure
      */
     public function __construct($argument) {}
@@ -424,7 +425,7 @@ class ReflectionFunction extends ReflectionFunctionAbstract
 {
     /**
      * @param callable-string|Closure $function
-     *
+     * @psalm-taint-sink callable $function
      * @psalm-pure
      */
     public function __construct(callable $function) {}

diff --git a/tests/TaintTest.php b/tests/TaintTest.php
@@ -2489,6 +2489,20 @@ public static function getPrevious(string $s): string {
                     echo pg_escape_string($conn, $_GET["a"]);',
                 'error_message' => 'TaintedHtml',
             ],
+            'taintedReflectionClass' => [
+                'code' => '<?php
+                    $name = $_GET["name"];
+                    $reflector = new ReflectionClass($name);
+                    $reflector->newInstance();',
+                'error_message' => 'TaintedCallable',
+            ],
+            'taintedReflectionFunction' => [
+                'code' => '<?php
+                    $name = $_GET["name"];
+                    $function = new ReflectionFunction($name);
+                    $function->invoke();',
+                'error_message' => 'TaintedCallable',
+            ],
         ];
     }