Security analysis annotations
@psalm-taint-source <taint-type> [return['key']]
See Custom taint sources.
@psalm-taint-sink <taint-type #conditional> <param-name>
See Custom taint sinks and Conditional sinks.
@psalm-taint-escape <taint-type #conditional>
@psalm-taint-unescape <taint-type>
Taint type complements
Wherever these annotations take a <taint-type>, ~(<taint-type>|<taint-type>) (or ~<taint-type> for one) stands
for every taint but the ones listed: the built-in ones (user_secret and system_secret too), the custom ones,
including those other annotations only register later. The ones listed may be aliases, like input. Write it without
spaces.
<?php // --taint-analysis
/**
* Taken from the request line, which can't hold a line break: any input but a header injection
*
* @psalm-taint-source ~(header|user_secret|system_secret)
*/
function getRequestPath(): string {}
The taints the native types of a value can't hold are still removed from it: a string returned by
getRequestPath() above can't be a NoSQL query.
@psalm-cli-only
See Output of command-line code.
@psalm-taint-property-bag $<property>
On a class: the array property $<property> holds the properties of its objects under their names.
See Properties held in an array property
@psalm-taint-specialize
See Specializing taints in functions and Specializing taints in classes.
@psalm-flow [proxy <function-like>] ( <arg>, [ <arg>, ] ) [ -> return ]
See Taint Flow.
Each <arg> is a parameter, like $value. With -> return, an <arg> can also be:
$this: the object the method is called on- a parameter followed by
(), like$compute(): what the callables passed to that parameter return
@psalm-flow ( <arg>, [ <arg>, ] ) -> <Class>::$<store>[<key>] and @psalm-flow <Class>::$<store>[<key>] -> return
See Keyed stores
@psalm-flow ( <arg>, [ <arg>, ] ) -> $this-><name> and @psalm-flow $this-><name> -> return
<name> is a parameter giving the name of the property, like $name, or * for any property.
See Properties set and got by name
@psalm-flow ( <arg>, [ <arg>, ] ) -> $this->{key} and @psalm-flow $this->{key} -> return[key]
Each property is set to, or returned under, its name as a key of the array. See Properties set and got by name
@psalm-flow ( <arg>, [ <arg>, ] ) -> $this-><property>[<key>] and @psalm-flow $this-><property>[<key>] -> return
<property> is the name of the property, like vars. The optional [<key>] is the element of that array property
under the key given to a parameter, like [$name], or [*] for any element.
See A property and its elements