test: simplify taint tests for variable assignment

vimeo · Jan 23, 2024 · 4640aa6 · 4640aa6
1 parent 923b57e
commit 4640aa6
Showing 1 changed file with 46 additions and 13 deletions.
diff --git a/tests/Config/Plugin/EventHandler/AddTaints/AddTaintsInterfaceTest.php b/tests/Config/Plugin/EventHandler/AddTaints/AddTaintsInterfaceTest.php
@@ -98,7 +98,7 @@ public function testTaintBadDataVariables(): void
         $this->analyzeFile($file_path, new Context());
     }
 
-    public function testAddTaintsActiveRecord(): void
+    public function testTaintsArePassedByTaintedAssignments(): void
     {
         $this->project_analyzer = $this->getProjectAnalyzerWithConfig(
             TestConfig::loadFromXML(
@@ -112,7 +112,7 @@ public function testAddTaintsActiveRecord(): void
                         <directory name="src" />
                     </projectFiles>
                     <plugins>
-                        <plugin filename="examples/plugins/TaintActiveRecords.php" />
+                        <plugin filename="tests/Config/Plugin/EventHandler/AddTaints/TaintBadDataPlugin.php" />
                     </plugins>
                 </psalm>',
             ),
@@ -126,14 +126,8 @@ public function testAddTaintsActiveRecord(): void
             $file_path,
             '<?php // --taint-analysis
 
-            namespace app\models;
-
-            class User {
-                public string $name = "<h1>Micky Mouse</h1>";
-            }
-
-            $user = new User();
-            echo $user->name;
+            $foo = $bad_data;
+            echo $foo;
             ',
         );
 
@@ -145,7 +139,47 @@ class User {
         $this->analyzeFile($file_path, new Context());
     }
 
-    public function testAddTaintsActiveRecordKeepInVariables(): void
+    public function testTaintsAreOverriddenByRawAssignments(): void
+    {
+        $this->project_analyzer = $this->getProjectAnalyzerWithConfig(
+            TestConfig::loadFromXML(
+                dirname(__DIR__, 5) . DIRECTORY_SEPARATOR,
+                '<?xml version="1.0"?>
+                <psalm
+                    errorLevel="6"
+                    runTaintAnalysis="true"
+                >
+                    <projectFiles>
+                        <directory name="src" />
+                    </projectFiles>
+                    <plugins>
+                        <plugin filename="tests/Config/Plugin/EventHandler/AddTaints/TaintBadDataPlugin.php" />
+                    </plugins>
+                </psalm>',
+            ),
+        );
+
+        $this->project_analyzer->getCodebase()->config->initializePlugins($this->project_analyzer);
+
+        $file_path = getcwd() . '/src/somefile.php';
+
+        $this->addFile(
+            $file_path,
+            '<?php // --taint-analysis
+
+            $foo = $bad_data;
+            $foo = "I am not bad!";
+            echo $foo;
+            ',
+        );
+
+        $this->project_analyzer->trackTaintedInputs();
+        // No exceptions should be thrown
+
+        $this->analyzeFile($file_path, new Context());
+    }
+
+    public function testAddTaintsActiveRecord(): void
     {
         $this->project_analyzer = $this->getProjectAnalyzerWithConfig(
             TestConfig::loadFromXML(
@@ -180,8 +214,7 @@ class User {
             }
 
             $user = new User();
-            $userName = $user->name;
-            echo $userName;
+            echo $user->name;
             ',
         );