Skip to content

Documentation Security analysis annotations
Type to start searching
    GitHub
    Psalm docs
    • Home
    • Running Psalm
      • Installation
      • Configuration
      • Plugins
        • Using plugins
        • Authoring plugins
        • How Psalm represents types
      • Command line usage
      • IDE support
      • Dealing with code issues
      • Issue Types
        • Overview
        • AbstractInstantiation
        • AbstractMethodCall
        • AmbiguousConstantInheritance
        • ArgumentTypeCoercion
        • AssignmentToVoid
        • CheckType
        • CircularReference
        • ClassMustBeFinal
        • ComplexFunction
        • ComplexMethod
        • ConfigIssue
        • ConflictingReferenceConstraint
        • ConstantDeclarationInTrait
        • ConstructorSignatureMismatch
        • ContinueOutsideLoop
        • DeprecatedClass
        • DeprecatedConstant
        • DeprecatedFunction
        • DeprecatedInterface
        • DeprecatedMethod
        • DeprecatedProperty
        • DeprecatedTrait
        • DirectConstructorCall
        • DocblockTypeContradiction
        • DuplicateArrayKey
        • DuplicateClass
        • DuplicateConstant
        • DuplicateEnumCase
        • DuplicateEnumCaseValue
        • DuplicateFunction
        • DuplicateMethod
        • DuplicateParam
        • DuplicateProperty
        • EmptyArrayAccess
        • ExtensionRequirementViolation
        • FalsableReturnStatement
        • FalseOperand
        • ForbiddenCode
        • IfThisIsMismatch
        • ImmutableDependency
        • ImplementationRequirementViolation
        • ImplementedParamTypeMismatch
        • ImplementedReturnTypeMismatch
        • ImplicitToStringCast
        • ImpureByReferenceAssignment
        • ImpureFunctionCall
        • ImpureGlobalVariable
        • ImpureMethodCall
        • ImpurePropertyAssignment
        • ImpurePropertyFetch
        • ImpureStaticProperty
        • ImpureStaticVariable
        • ImpureVariable
        • InaccessibleClassConstant
        • InaccessibleMethod
        • InaccessibleProperty
        • IncompatibleTypeParameters
        • InheritorViolation
        • InterfaceInstantiation
        • InternalClass
        • InternalMethod
        • InternalProperty
        • InvalidArgument
        • InvalidArrayAccess
        • InvalidArrayAssignment
        • InvalidArrayOffset
        • InvalidAttribute
        • InvalidCast
        • InvalidCatch
        • InvalidClass
        • InvalidClassConstantType
        • InvalidClone
        • InvalidConstantAssignmentValue
        • InvalidDocblock
        • InvalidDocblockParamName
        • InvalidEnumBackingType
        • InvalidEnumCaseValue
        • InvalidEnumMethod
        • InvalidExtendClass
        • InvalidFalsableReturnType
        • InvalidFunctionCall
        • InvalidGlobal
        • InvalidInterfaceImplementation
        • InvalidIterator
        • InvalidLiteralArgument
        • InvalidMethodCall
        • InvalidNamedArgument
        • InvalidNullableReturnType
        • InvalidOperand
        • InvalidOverride
        • InvalidParamDefault
        • InvalidParent
        • InvalidPassByReference
        • InvalidPropertyAssignment
        • InvalidPropertyAssignmentValue
        • InvalidPropertyFetch
        • InvalidReturnStatement
        • InvalidReturnType
        • InvalidScalarArgument
        • InvalidScope
        • InvalidStaticInvocation
        • InvalidStringClass
        • InvalidTemplateParam
        • InvalidThrow
        • InvalidToString
        • InvalidTraversableImplementation
        • InvalidTypeImport
        • LessSpecificClassConstantType
        • LessSpecificImplementedReturnType
        • LessSpecificReturnStatement
        • LessSpecificReturnType
        • LiteralKeyUnshapedArray
        • LoopInvalidation
        • MethodSignatureMismatch
        • MethodSignatureMustOmitReturnType
        • MethodSignatureMustProvideReturnType
        • MismatchingDocblockParamType
        • MismatchingDocblockPropertyType
        • MismatchingDocblockReturnType
        • MissingAbstractPureAnnotation
        • MissingClassConstType
        • MissingClosureParamType
        • MissingClosureReturnType
        • MissingConstructor
        • MissingDependency
        • MissingDocblockType
        • MissingFile
        • MissingImmutableAnnotation
        • MissingInterfaceImmutableAnnotation
        • MissingOverrideAttribute
        • MissingParamType
        • MissingPropertyType
        • MissingPureAnnotation
        • MissingReturnType
        • MissingTemplateParam
        • MissingThrowsDocblock
        • MixedArgument
        • MixedArgumentTypeCoercion
        • MixedArrayAccess
        • MixedArrayAssignment
        • MixedArrayOffset
        • MixedArrayTypeCoercion
        • MixedAssignment
        • MixedClone
        • MixedFunctionCall
        • MixedMethodCall
        • MixedOperand
        • MixedPropertyAssignment
        • MixedPropertyFetch
        • MixedPropertyTypeCoercion
        • MixedReturnStatement
        • MixedReturnTypeCoercion
        • MixedStringOffsetAssignment
        • MoreSpecificImplementedParamType
        • MoreSpecificReturnType
        • MutableDependency
        • NamedArgumentNotAllowed
        • NoEnumProperties
        • NoInterfaceProperties
        • NonInvariantDocblockPropertyType
        • NonInvariantPropertyType
        • NonStaticSelfCall
        • NonVariableReferenceReturn
        • NoValue
        • NullableReturnStatement
        • NullArgument
        • NullArrayAccess
        • NullArrayOffset
        • NullFunctionCall
        • NullIterator
        • NullOperand
        • NullPropertyAssignment
        • NullPropertyFetch
        • NullReference
        • OverriddenFinalConstant
        • OverriddenFinalProperty
        • OverriddenInterfaceConstant
        • OverriddenMethodAccess
        • OverriddenPropertyAccess
        • ParadoxicalCondition
        • ParamNameMismatch
        • ParentNotFound
        • ParseError
        • PluginIssue
        • PossibleRawObjectIteration
        • PossiblyFalseArgument
        • PossiblyFalseIterator
        • PossiblyFalseOperand
        • PossiblyFalsePropertyAssignmentValue
        • PossiblyFalseReference
        • PossiblyInvalidArgument
        • PossiblyInvalidArrayAccess
        • PossiblyInvalidArrayAssignment
        • PossiblyInvalidArrayOffset
        • PossiblyInvalidCast
        • PossiblyInvalidClone
        • PossiblyInvalidDocblockTag
        • PossiblyInvalidFunctionCall
        • PossiblyInvalidIterator
        • PossiblyInvalidMethodCall
        • PossiblyInvalidOperand
        • PossiblyInvalidPropertyAssignment
        • PossiblyInvalidPropertyAssignmentValue
        • PossiblyInvalidPropertyFetch
        • PossiblyNullArgument
        • PossiblyNullArrayAccess
        • PossiblyNullArrayAssignment
        • PossiblyNullArrayOffset
        • PossiblyNullFunctionCall
        • PossiblyNullIterator
        • PossiblyNullOperand
        • PossiblyNullPropertyAssignment
        • PossiblyNullPropertyAssignmentValue
        • PossiblyNullPropertyFetch
        • PossiblyNullReference
        • PossiblyUndefinedArrayOffset
        • PossiblyUndefinedGlobalVariable
        • PossiblyUndefinedIntArrayOffset
        • PossiblyUndefinedMethod
        • PossiblyUndefinedStringArrayOffset
        • PossiblyUndefinedVariable
        • PossiblyUnusedMethod
        • PossiblyUnusedParam
        • PossiblyUnusedProperty
        • PossiblyUnusedReturnValue
        • PrivateFinalMethod
        • PropertyNotSetInConstructor
        • PropertyTypeCoercion
        • RawObjectIteration
        • RedundantCast
        • RedundantCastGivenDocblockType
        • RedundantCondition
        • RedundantConditionGivenDocblockType
        • RedundantFlag
        • RedundantFunctionCall
        • RedundantFunctionCallGivenDocblockType
        • RedundantIdentityWithTrue
        • RedundantPropertyInitializationCheck
        • ReferenceConstraintViolation
        • ReferenceReusedFromConfusingScope
        • ReservedWord
        • RiskyCast
        • RiskyTruthyFalsyComparison
        • StringIncrement
        • TaintedCallable
        • TaintedCookie
        • TaintedCustom
        • TaintedEval
        • TaintedExtract
        • TaintedFile
        • TaintedHeader
        • TaintedHtml
        • TaintedInclude
        • TaintedInput
        • TaintedLdap
        • TaintedLlmPrompt
        • TaintedNosql
        • TaintedShell
        • TaintedSleep
        • TaintedSql
        • TaintedSSRF
        • TaintedSystemSecret
        • TaintedTextWithQuotes
        • TaintedUnserialize
        • TaintedUserSecret
        • TaintedXpath
        • TooFewArguments
        • TooManyArguments
        • TooManyTemplateParams
        • Trace
        • TraitMethodSignatureMismatch
        • TypeDoesNotContainNull
        • TypeDoesNotContainType
        • UncaughtThrowInGlobalScope
        • UndefinedAttributeClass
        • UndefinedClass
        • UndefinedConstant
        • UndefinedDocblockClass
        • UndefinedFunction
        • UndefinedGlobalVariable
        • UndefinedInterface
        • UndefinedInterfaceMethod
        • UndefinedMagicMethod
        • UndefinedMagicPropertyAssignment
        • UndefinedMagicPropertyFetch
        • UndefinedMethod
        • UndefinedPropertyAssignment
        • UndefinedPropertyFetch
        • UndefinedThisPropertyAssignment
        • UndefinedThisPropertyFetch
        • UndefinedTrace
        • UndefinedTrait
        • UndefinedVariable
        • UnevaluatedCode
        • UnhandledMatchCondition
        • UnimplementedAbstractMethod
        • UnimplementedInterfaceMethod
        • UninitializedProperty
        • UnnecessaryVarAnnotation
        • UnrecognizedExpression
        • UnrecognizedStatement
        • UnresolvableConstant
        • UnresolvableInclude
        • UnsafeGenericInstantiation
        • UnsafeInstantiation
        • UnsupportedPropertyReferenceUsage
        • UnsupportedReferenceUsage
        • UnusedBaselineEntry
        • UnusedClass
        • UnusedClosureParam
        • UnusedConstructor
        • UnusedDocblockParam
        • UnusedForeachValue
        • UnusedFunctionCall
        • UnusedIssueHandlerSuppression
        • UnusedMethod
        • UnusedMethodCall
        • UnusedParam
        • UnusedProperty
        • UnusedPsalmSuppress
        • UnusedReturnValue
        • UnusedVariable
      • Checking non-PHP files
      • Error levels
    • Annotating code
      • Typing in Psalm
      • Supported Annotations
      • Template Annotations
      • Type Variables
      • Adding assertions
      • Assertion syntax
      • Type syntax
        • Array types
        • Atomic types
        • Callable types
        • Conditional types
        • Intersection types
        • Object types
        • Other types
        • Scalar types
        • Top types, bottom types
        • Union Types
        • Utility types
        • Value types
    • Manipulating code
      • Fixing code
      • Refactoring code
    • Contributing
      • Overview
      • How Psalm works
      • Philosophy
      • Things that make developing Psalm complicated
      • Altering callmaps
      • Adding a new issue type
    • Security analysis
      • Overview
      • Custom Taint Sources
      • Custom Taint Sinks
      • Avoiding false-positives
      • Avoiding false-negatives
      • Security analysis annotations
        • @psalm-taint-source <taint-type>
        • @psalm-taint-sink <taint-type> <param-name>
        • @psalm-taint-escape <taint-type #conditional>
        • @psalm-taint-unescape <taint-type>
        • @psalm-taint-specialize
        • @psalm-flow [proxy <function-like>] ( <arg>, [ <arg>, ] ) [ -> return ]
      • Taint Flow
    Docs source on GitHub
    • @psalm-taint-source <taint-type>
    • @psalm-taint-sink <taint-type> <param-name>
    • @psalm-taint-escape <taint-type #conditional>
    • @psalm-taint-unescape <taint-type>
    • @psalm-taint-specialize
    • @psalm-flow [proxy <function-like>] ( <arg>, [ <arg>, ] ) [ -> return ]
    

    Security analysis annotations

    @psalm-taint-source <taint-type>

    See Custom taint sources.

    @psalm-taint-sink <taint-type> <param-name>

    See Custom taint sinks.

    @psalm-taint-escape <taint-type #conditional>

    See Escaping tainted output.

    @psalm-taint-unescape <taint-type>

    See Unescaping statements.

    @psalm-taint-specialize

    See Specializing taints in functions and Specializing taints in classes.

    @psalm-flow [proxy <function-like>] ( <arg>, [ <arg>, ] ) [ -> return ]

    See Taint Flow

    Previous Security Analysis in Psalm
    Next Avoiding false-negatives
    powered by MkDocs and Material for MkDocs