psalm/plugin-laravel v4.15.3

on PHP Packagist

Taint precision for where() array forms and redirect responses.

Fixes

• Fix TaintedSql false positives on where([[...]]) nested-condition arrays: a static receiver spelling (Model::where(...)) skipped the strip entirely, and the inner condition value was scalar-gated so any mixed-typed request value (the common case) kept the sink. Also closes a false negative where a Model subclass with its own concrete where() override had its real sink stripped (#1314).

 $term = (string) $request->input('term');
-User::where([['name', '=', $term]])->get();
-// TaintedSql (false positive) -- static receiver wasn't recognized as PDO-bound

 User::where([['code', '=', $request->keyword]])->first();
-// TaintedSql (false positive) -- mixed-typed value failed the scalar gate
+// clean -- both forms are PDO-bound, matching the instance-receiver behavior

• Fix TaintedSSRF incorrectly firing alongside TaintedHeader on redirect() and the Redirector/ResponseFactory redirect family. A redirect sets a Location header for the browser to follow; the server makes no outbound request, so it's an open-redirect/header-injection sink, not SSRF (#1315).

-return redirect($request->url());
-// TaintedSSRF + TaintedHeader (SSRF was mislabelled)
+return redirect($request->url());
+// TaintedHeader only

Full Changelog: v4.15.2...v4.15.3