Security analysis
Support for sending analysis GitHub Security
Thanks to @LukasReschke, Psalm can now output its results in a format compatible with GitHub's Code Scanning feature (#4582)
More specific output for security issues
Psalm now separates out different security issues it finds, with code snippets that reproduce the issue e.g. TaintedHtml and TaintedUnserialize
Bugfixes
Inheritance for docblock return and param types
This ticket – #4537 – revealed a slight issue with Psalm's automatic inheritance of docblock param and return types.
Psalm will now only inherit docblock parameter and return types from a single docblock, which means you can't define param types in one parent class method and return types in another. It's a relatively minor change, but it might break some code.
Other bugfixes
- Security Analysis: @LukasReschke made a lot of improvements to Psalm's taint analysis (#4554, #4572, #4576, #4592, #4604, #4630)
- @pilif improved the
mb_strtolower
return type (#4469) - perform better inference for literal int division (#2132)
- fix bugs caused by around
ReflectionProperty
stub not implementingReflector
(#4481) - better error message for
PossiblyInvalidArrayOffset
(#4479) - support assertions in
new
calls (#4491) - fix type inference when unpacking typed iterables (#4487)
- @orklah added some undocumented properties to
SoapFault
(#4510) - @wouterj added support for reflecting builtin PHP union types (#4505)
- autoloaded constants set in
define
are now inferred asmixed
(#4509) - prevent crash with empty match expression (#4519)
- treat
exit
expressions as the empty type (#4516) - track type contradiction issues in match expressions (#4517)
- remember assignments when descending into property use (#4522)
- @adrienlucas added support for proxying functions for taint analysis (#4495)
- improve template param inference (#4485, #4524, #4545)
- fix property initialisation checks when parent::__construct refers to grandparent class (#4540)
- allow better
get_class
inference insidematch
expressions (#4544) - mark closure uses as UnusedVariable where possible (#4547)
- prevent false-positive warning about calling
unset
on array with key (#4529) - @orklah added a check for accessing an array with a negative int offset (#4552)
- @thomasvargiu fixed a bug intersecting with templated types (#4560)
- @duskwuff added support for passing named arguments to functions that use variadic params (#4575)
- added a more specific return type for
substr
in PHP 8 (#4580) - @BenMorel improved
mysqli
property types and aDateTimeInterface
signature (#4577, #4579) - @mstilkerich added a more accurate stub for
preg_filter
(#4587) - improved a lot of tainting (#4599, #4605)
- prevent negative line numbers in output (#4600)
- prevent string literals from carrying taints (#4620)
- improve inference of
array_key_exists
when the first arg is a variable (#4626) - @orklah improved return type updating when returning
$this
orstatic
(#4632)