•  
      request #15015 Initiate usage of Psalm taint analysis feature
    Infos
    #15015
    Thomas Gerbet (tgerbet)
    2020-11-06 17:01
    2020-06-25 09:30
    16130
    Details
    Initiate usage of Psalm taint analysis feature
    Psalm 3.11.7/3.12.0 has (officially) announced its taint analysis capability, see the introductory blogpost [0] to see what it's all about.

    The goal is going to make it usable and useful with the Tuleap codebase. This request will cover the first stage:
    * making it work
    * configuring it enough via annotations/custom plugins so we can catch straightforward SQL injections. Basically introducing issues like request #14770 must be become much harder for the developer
    * adding it somewhere in a CI pipeline



    [0] https://psalm.dev/articles/detect-security-vulnerabilities-with-psalm
    Dev tools
    Empty
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Thomas Gerbet (tgerbet)
    Closed
    2020-10-15
    Attachments
    Empty
    References
    Referencing request #15015

    Git commit

    tuleap/tuleap/stable

    Psalm can be launched in the taint analysis mode f1479a5151
    Stop loading the database.inc into the global scope eb6c9fe646
    Exclude legacy trackers from Psalm taint analysis d9d1df69d7
    Remove taint analysis false positives in TLP doc 48597d1a1b
    Stop loading the local.inc into the global scope b60960432b
    Correct syntax error in mail/index f45551c902
    Fix SA issues in TLP doc 9540df216e
    LDAP welcome page still relies on settings being available in $GLOBALS 5e87ad2616
    DB/integration testsuite fails due to an improperly cleaned setup 478d4b38d1
    Move remaining configuration settings accessed via the global scope to \ForgeConfig 0efc5b6637
    Fix false positive issues identified by Psalm taint analysis 2ed8472fc4
    Crash when \Response::sendStatusCode() is called 005e702e23
    Fix issues found by Psalm's taint analysis after the upgrade to 3.13 93c82268aa
    Mark \Codendi_Request::get() as an input source e94fa67ee3
    Mark Tuleap legacy DB interfaces as SQL sinks 32fc0be33e
    Mark SQL sinks on the EasyDB interface a1e453511b
    Run Psalm taint analysis in a CI pipeline 1c647614a2

    Follow-ups