Skip to content

Commit 29eb830

Browse files
committed
Remove taint annotation as it could confuse
1 parent d462830 commit 29eb830

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

docs/security_analysis/avoiding_false_positives.md

+8-8
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ Some operations remove taints from data – for example, wrapping `$_GET['name']
1313
Psalm allows you to remove taints via a `@psalm-taint-escape <taint-type>` annotation:
1414

1515
```php
16-
<?php // trackTaints
16+
<?php
1717

1818
function echoVar(string $str) : void {
1919
/**
@@ -31,7 +31,7 @@ echoVar($_GET["text"]);
3131
For functions, methods and classes you can use the `@psalm-taint-specialize` annotation.
3232

3333
```php
34-
<?php // trackTaints
34+
<?php
3535

3636
function takesInput(string $s) : string {
3737
return $s;
@@ -44,7 +44,7 @@ echo takesInput("hello"); // Psalm detects tainted HTML here
4444
Adding a `@psalm-taint-specialize` annotation solves the problem, by telling Psalm that each invocation of the function should be treated separately.
4545

4646
```php
47-
<?php // trackTaints
47+
<?php
4848

4949
/**
5050
* @psalm-taint-specialize
@@ -60,7 +60,7 @@ echo takesInput("hello"); // No error
6060
A specialized function or method will still track tainted input:
6161

6262
```php
63-
<?php // trackTaints
63+
<?php
6464

6565
/**
6666
* @psalm-taint-specialize
@@ -78,7 +78,7 @@ Here we’re telling Psalm that a function’s taintedness is wholly depenedent
7878
If you're familiar with [immutability in Psalm](https://psalm.dev/articles/immutability-and-beyond) then this general idea should be familiar, since a pure function is one where the output is wholly dependent on its input. Unsurprisingly, all functions marked `@psalm-pure` _also_ specialize the taintedness of their output based on input:
7979

8080
```php
81-
<?php // trackTaints
81+
<?php
8282

8383
/**
8484
* @psalm-pure
@@ -96,7 +96,7 @@ echo takesInput("hello"); // No error
9696
Just as taints can be specialized in function calls, tainted properties can also be specialized to a given class.
9797

9898
```php
99-
<?php // trackTaints
99+
<?php
100100

101101
class User {
102102
public string $name;
@@ -122,7 +122,7 @@ echoUserName($user1);
122122
Adding `@psalm-taint-specialize` to the class fixes the issue.
123123

124124
```php
125-
<?php // trackTaints
125+
<?php
126126

127127
/**
128128
* @psalm-taint-specialize
@@ -151,7 +151,7 @@ echoUserName($user1);
151151
And, because it’s form of purity enforcement, `@psalm-immutable` can also be used:
152152

153153
```php
154-
<?php // trackTaints
154+
<?php
155155

156156
/**
157157
* @psalm-immutable

0 commit comments

Comments
 (0)