* QUAL: Add SqlInjectionPlugin to detect unsafe SQL variable usage
# QUAL: Add SqlInjectionPlugin to detect unsafe SQL variable usage
This commit adds a new SqlInjectionPlugin to the Phan configuration, which helps detect unsafe SQL variable usage in the Dolibarr codebase. The plugin checks for variables used in sql expressions that are not properly escaped, cast, or protected by safe methods.
* Qual: Add SqlInjection exceptions to Phan baseline
* Qual: Add SqlInjection exceptions to Phan baseline
* Qual: Update baseline.txt to remove SqlInjection suppressions
The SqlInjection suppressions have been removed from the baseline.txt file.
This reenables the notification of "unfixed" cases.
* Qual: SQL injection detection for missing quotes on escaped strings
# Qual: SQL injection detection for missing quotes on escaped strings
In summary: report lines with missing quotes as in `" WHERE ".$db->escape($value)." OR "`.
* Qual: Fix code for SqlInjection analysis
# Qual: Fix code for SqlInjection analysis
Rewrite some escape calls, change escape() in sanitize(), rename variable, ignore SqlInjection notices.
* Qual: Update baseline
Allow some SqlInjection* notices, to be fixed later or already fixed in develop.
# Qual: Update baseline, enable PhanTypeMismatchArgument
Update the baseline for fixes.
Enable PhanTypeMismatchArgument as this is being fixed and to avoid
that new cases occur in files where these are fixed.
Only about 3800 cases remain, was more than 12000 when starting with Phan.
* Do not analyze custom
* Update baseline, ignore everything in custom
* Qual: Fix notices in files related to ticket class
* Qual: Add typing hints to tpl files + other 'fixes'
* Qual: fix typing issu gy typing intermediate variable
* Qual: Enable & fix or ignore Invalid DimOffset
# Qual: Enable & fix or ignore Invalid DimOffset
The Invalid DimOffset notices occur when array keys are defined and
the index used is not amongst the known array keys.
This PR enables these notices and fixes array definitions when needed,
or ignores the notices locally if it's a false positive, or in the
baseline.txt when it does not seem to be a false positive so that
it can be fixed later
* Nullable object typing in function signature not ok for 7.0/8.4
Can't user '?User' as argument type for PHP7.0 which is required by PHP8.4.
Therefore, removing the typing specification in the function definition
---------
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
# Qual: Disable PhanPluginDuplicateCatchStatementBody which requires PHP7.1 for fix
To fix this PHP7.1 is required, so skipping the message in the extended
report as well.
* Qual: phan: Add more global definitions
# Qual: phan: Add more global definitions
Add some more typing information for globals
* Qual: phan: ignore local conf file which may contain exceptions
* Qual: phan: add a few more global typings
* Qual: Enable detection of deprecated modulename & GETPOST(...,'int')
# Qual: Enable detection of deprecated modulename & GETPOST(...,'int')
Enable phan rules to verify deprecated modulename usage and GETPOST(...,'int')
usage in the code.
* Qual: Try type hint on to help avoid notification
* Qual: Accept 3 parameters for GETPOST to GETPOSTINT conversion
* Qual: Convert GETPOST(...,'int',VALUE) to GETPOSTINT(...,VALUE)
# Qual: Convert GETPOST(...,'int',VALUE) to GETPOSTINT(...,VALUE)
Following the update to the fixer to also convert GETPOST... with 3 parameters.
The files are now converted.
