Vimeo Company new release of the static analyzer , which allows for the detection of both obvious and hard-to-find errors in PHP code, as well as automatically fixing certain types of errors. The system is suitable for identifying issues in both outdated code and code utilizing modern features introduced in new PHP branches. The project code is written in PHP and is licensed under the MIT License.
Psalm identifies most issues associated with incorrect type usage, as well as various . For instance, it supports the output of warnings about mixing variables of different types in expressions, incorrect logical checks (such as "if ($a && $a) {}", "if ($a && !$a) {}" and "if ($a) {} elseif ($a) {}"), and incomplete initialization of object properties. The analyzer runs in multi-threaded mode. Incremental checks are possible, analyzing only the files that have changed since the last check.
Additionally, tools for safe programming are provided, allowing annotations in the format ("/** @var Type */") to provide information about variable types, return values, function parameters, and object properties. It also supports defining patterns for type usage and applying assert expressions. For example:
/** @var string|null */
$a = foo();
/** @var string $a */
echo strpos($a, 'hello');
/** @psalm-assert-if-true B $a */
function isValidB(A $a) : bool {
return $a instanceof B && $a->isValid();
}
To automate the resolution of identified issues, a utility called Psalter is provided, which supports plugins and resolves typical problems in the code, adds type annotations, and performs operations such as moving classes from one namespace to another, moving methods between classes, renaming classes and methods.
In the new release of Psalm the option «—taint-analysis», which allows tracking the connection between user-provided input parameters (for example, $_GET['name']) and their usage in places that require character escaping (for instance, echo «<h1>$name</h1>»), including through tracking chains of intermediate assignments and function calls. Sources of potentially dangerous data include the use of associative arrays $_GET, $_POST, and $_COOKIE, but it is also possible to own sources. The actions requiring escape tracking include output operations that generate content in HTML format, adding HTTP headers, or executing SQL queries.
The check is applied when using functions such as echo, exec, include, and header. When analyzing the need for escaping, data types such as text, SQL strings, HTML, and Shell code, as well as strings with authentication parameters, are taken into account. The proposed mode allows for detecting vulnerabilities in code that lead to cross-site scripting (XSS) or SQL injection.
Additionally, it can be noted alpha testing of the new PHP 8.0 branch. The release is scheduled for November 26. The new branch is expected to feature , such as:
- , whose implementation will increase performance.
- Support , defining collections of two or more types (for example, 'public function foo(Foo|Bar $input): int|float;').
- Support (annotations) that allow binding metadata (e.g., type information) to classes without using the Docblock syntax.
- for class definitions, allowing the constructor and property definitions to be combined.
- A new return type — .
- The new type — , which can be used to define a function's acceptance of parameters of different types.
- Expression for handling exceptions.
- for creating objects that can be garbage collected (for example, for storing optional caches).
- using the expression '::class' for objects (similar to calling get_class()).
- definitions in the catch block of exceptions not bound to variables.
- leaving a comma after the last element in a function parameter list.
- better matches the browser interface. Support for AcroForm (form filling will be included later, activated via the setting pdfjs.renderInteractiveForms) has been added. to identify any string types or data that can be converted to a string (for which the method __toString() is available).
- A new function , a simplified equivalent of strpos for determining substring presence, as well as the functions str_starts_with() and str_ends_with() for checking matches at the beginning and end of a string.
- A function has been added , which performs division without throwing an error in the case of division by zero.
- the logic for string concatenation. For example, the expression 'echo "sum: " . $a + $b' was previously interpreted as 'echo ("sum: " . $a) + $b', whereas in PHP 8 it will be processed as 'echo "sum: " . ($a + $b)'.
- checks for arithmetic and bitwise operations, for example, the expressions '[] % [42]' and '$object + 4' will result in an error.
- a stable sorting algorithm, in which the order of identical values is preserved across different runs.
Source: opennet.ru
