psalm/plugin-laravel v4.15.2

on PHP Packagist

Taint-analysis precision for the query where() family. Resolves the TaintedSql inconsistency from #1300 (the same safe query reported or stayed silent depending on how it was written), and closes two SQL source/sink gaps.

Features 🛡️

• Source Request::__get() as user input, so $request->term carries taint like $request->input('term') (#1305).

 DB::table('t')->whereRaw((string) $request->input('term')); // TaintedSql
-DB::table('t')->whereRaw((string) $request->term);          // silent
+DB::table('t')->whereRaw((string) $request->term);          // TaintedSql

• Add SQL taint sinks to whereColumn() / orWhereColumn() on all three identifier positions, which the grammar emits raw (#1308).

-$builder->whereColumn((string) $request->input('c'), '=', 'other'); // silent
+$builder->whereColumn((string) $request->input('c'), '=', 'other'); // TaintedSql

• Gate the whole-argument where() sql-taint strip on a Laravel builder receiver, so a non-builder where(array $parts) that interpolates raw SQL keeps its report (#1311).

Fixes

• Fix where() array forms raising a false TaintedSql on PDO-bound value positions; the strip now walks the array literal element-wise and keeps the sink only on raw-identifier positions (#1302, fixes #1300).

 $term = (string) $request->input('term');
-Model::where([['name', 'LIKE', "%{$term}%"]]); // TaintedSql (false positive)
+Model::where([['name', 'LIKE', "%{$term}%"]]); // clean — value is PDO-bound

• Widen the whereLike-family $value param to mixed, matching where() and the PDO-bound runtime, so idiomatic calls stop reporting false positives (#1312).

-Model::whereLike('name', $request->query('q')); // PossiblyInvalidArgument
+Model::whereLike('name', $request->query('q')); // clean

Full Changelog: v4.15.1...v4.15.2