Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[RFR] Tainting twig #61

Merged
merged 35 commits into from
Sep 13, 2020
Merged

[RFR] Tainting twig #61

merged 35 commits into from
Sep 13, 2020

Conversation

adrienlucas
Copy link
Contributor

@adrienlucas adrienlucas commented Jul 27, 2020 •
edited
Loading

There are two approaches in here :

  • one based on a TemplateFileAnalyzer which uses the twig parser to taint twig AST nodes
  • one based on the already compiled twig templates

The two have their own advantages.

@adrienlucas adrienlucas mentioned this pull request Jul 27, 2020
Merged
@adrienlucas adrienlucas force-pushed the tainting-twig branch 3 times, most recently from c9325a4 to 54f9c8b Compare August 21, 2020 18:18
@seferov
Copy link
Member

seferov commented Aug 22, 2020

@adrienlucas thank you! This PR needs to be rebased.

adrienlucas and others added 25 commits August 25, 2020 10:52
@adrienlucas
Taint Request::get and Response::__construct
5c802fb
@adrienlucas
Taint Request::request, Request::query & Request::cookies
cbdcf78
@adrienlucas
Taint Request::headers (only for the user-agent header)
b456bb5
@adrienlucas
Taint HeaderBag::__toString (and a fix of psalm taint api usage)
d694407
@adrienlucas
Taint InputBag::all
a28c180
@adrienlucas
Fix type resolving
9d6a6ba
@adrienlucas
Bump psalm requirement
8e3df52
@adrienlucas
refactoring first scenario outline
1eb45fe
@adrienlucas
Refactor RequestTaint
df98124
@seferov @adrienlucas
no message
3f6bed7
@adrienlucas
Taint HeaderBag using the MethodReturnTypeProviderInterface
dc27963
@adrienlucas
Skip tests when dependencies too low
b0f8a98
@adrienlucas
Taint Request::get and Response::__construct
cae148d
@adrienlucas
Taint Request::headers (only for the user-agent header)
8b3b629
@adrienlucas
wip
b783632
@adrienlucas
Try using MethodReturnTypeProviderInterface
04fcf8e
@adrienlucas
Compiling templates
c57e1bf
@adrienlucas
Make it work using fake call
56e136a
@adrienlucas
Explicitely load compliled twig files
eb01ada
@adrienlucas
wip
a2b551b
@muglug @adrienlucas
Add more direct way of tainting output
d520fe1
@adrienlucas
wip
ca28ebd
@adrienlucas
Add real twig template analyzer
79523f6
@adrienlucas
Refactor
e269c71
@adrienlucas
Little fixes
22b0feb
@adrienlucas
Copy link
Contributor Author

hey @seferov thank you !
this is now ready for review !

seferov
seferov requested changes Aug 27, 2020
View reviewed changes
Copy link
Member

@seferov seferov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for great work! This one also needs a documentation update.

src/Test/CodeceptionModule.php Show resolved Hide resolved
tests/acceptance/acceptance/Tainting.feature Outdated Show resolved Hide resolved
@adrienlucas adrienlucas changed the title [WIP] Tainting twig [RFR] Tainting twig Sep 11, 2020
@seferov
Copy link
Member

seferov commented Sep 13, 2020

@adrienlucas thank you!

@seferov seferov merged commit 4eb4dae into psalm:master Sep 13, 2020
@micheh micheh mentioned this pull request Dec 5, 2020
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@seferov seferov seferov requested changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@adrienlucas @seferov @muglug