Psalm
Get started
Documentation
Paid support
Plugins
Blog
GitHub
<?php // --taint-analysis // Adding an (at)property string $taint would make psalm properly warn about this. class Magic { private $_params = []; public function __set(string $a, $value) { $this->_params[$a] = $value; } public function __get(string $a) { return $this->_params[$a]; } } $m = new Magic(); $m->taint = $_GET['input']; echo $m->taint; // There is no edge from Magic::$taint to echo. There's an edge from magic::__get to echo, though
Snippet created on June 24 2020 at 20:31 UTC
Settings
Get link