Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Connection Stubs #105

Merged
merged 2 commits into from
Nov 22, 2021
Merged

Connection Stubs #105

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8c077d7
add Connection::executeStatement to stubs
timglabisch Nov 22, 2021
1858d2f
Update Connection.phpstub
timglabisch Nov 22, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions stubs/Connection.phpstub
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,15 @@ class Connection implements DriverConnection
*/
public function executeUpdate(string $query, array $params = [], array $types = []): int {}

/**
* @psalm-param scalar[] $params The query parameters.
* @psalm-param int[]|string[] $types The parameter types.
*
* @throws DBALException
* @psalm-taint-sink sql $sql
*/
public function executeStatement($sql, array $params = [], array $types = []): int {}

/**
* @psalm-pure
*
Expand Down
12 changes: 7 additions & 5 deletions tests/acceptance/Tainting.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ Feature: Tainting
@Connection::exec
@Connection::query
@Connection::executeUpdate
@Connection::executeStatement
Scenario Outline: Using user input on Connection's query methods
Given I have the following code
"""
Expand All @@ -36,11 +37,12 @@ Feature: Tainting
| /TaintedInput\|TaintedSql/ | /Detected tainted (sql\|SQL)/ |
And I see no other errors
Examples:
| method |
| prepare |
| exec |
| query |
| executeUpdate |
| method |
| prepare |
| exec |
| query |
| executeUpdate |
| executeStatement |

@Connection::quote
Scenario: Using Connection's quote method on user input
Expand Down