All 7 Static Analysis (PHPStan & Psalm) questions
More in Static Analysis (PHPStan & Psalm)
What is static analysis, and how do tools like PHPStan and Psalm help catch bugs in PHP code before it is even run? What are analysis levels in PHPStan, and why would a project typically start at a lower level before gradually increasing strictness? How do type declarations and PHPDoc comments help a static analysis tool understand your code more accurately and catch more potential issues? What is a baseline file in PHPStan, and how does it help a team adopt static analysis on an existing project without needing to fix every single issue immediately? How can integrating a static analysis tool into a continuous integration pipeline help enforce consistent code quality across an entire team, and what are common strategies for managing false positives? How do custom PHPStan or Psalm rules and extensions let a team enforce their own project specific coding standards and catch domain specific mistakes beyond the tool's built in checks?
Advertisement
Back to results for “Security”
PHP › Static Analysis (PHPStan & Psalm)

How does Psalm's concept of taint analysis help detect potential security vulnerabilities like SQL injection or cross site scripting during static analysis?

Intermediate

Answer

Taint analysis tracks how data flows through an application starting from an untrusted source, such as user submitted form input, following that data through every function call and variable assignment it passes through, and flags a potential security issue if that tainted, untrusted data ever reaches a sensitive destination, called a sink, such as being directly concatenated into a raw SQL query or echoed directly into HTML output, without first being properly sanitized or escaped somewhere along that path.
vendor/bin/psalm --taint-analysis
Real-world example A security conscious team runs Psalm's taint analysis feature as part of their continuous integration pipeline, automatically catching a case where a developer accidentally passed raw, unescaped user input directly into an HTML template without first sanitizing it.

Common follow-ups: Can taint analysis realistically catch every possible security vulnerability in an application?;How does a team properly mark a specific data sanitization function as safely removing the taint from a value?

Security;Form Handling & Validation
All 7 Static Analysis (PHPStan & Psalm) questions