<?php /** * @return-taint tainted */ function getUnsafe() { // Line 6 } echo getUnsafe();
input:8: SecurityCheck-XSS Echoing expression that was not html escaped (Caused by: input +6)
The caused-by line should say something like "return value of \getUnsafe() is annotated at input.php +4", and not point to line 6.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Improve caused-by error for annotated functions | mediawiki/tools/phan/SecurityCheckPlugin | master | +115 -113 |
Change 961485 had a related patch set uploaded (by Daimona Eaytoy; author: Daimona Eaytoy):
[mediawiki/tools/phan/SecurityCheckPlugin@master] Improve caused-by error for annotated functions
return value of \getUnsafe() is annotated at input.php +4
This is not easy. By the time we set the annotation, we don't know what parameters are annotated, nor what lines the annotations are on. But I think even just a general message mentioning annotations would be better than the status quo.
Change 961485 merged by jenkins-bot:
[mediawiki/tools/phan/SecurityCheckPlugin@master] Improve caused-by error for annotated functions