a0b820564f
* QUAL: Add SqlInjectionPlugin to detect unsafe SQL variable usage # QUAL: Add SqlInjectionPlugin to detect unsafe SQL variable usage This commit adds a new SqlInjectionPlugin to the Phan configuration, which helps detect unsafe SQL variable usage in the Dolibarr codebase. The plugin checks for variables used in sql expressions that are not properly escaped, cast, or protected by safe methods. * Qual: Add SqlInjection exceptions to Phan baseline * Qual: Add SqlInjection exceptions to Phan baseline * Qual: Update baseline.txt to remove SqlInjection suppressions The SqlInjection suppressions have been removed from the baseline.txt file. This reenables the notification of "unfixed" cases. * Qual: SQL injection detection for missing quotes on escaped strings # Qual: SQL injection detection for missing quotes on escaped strings In summary: report lines with missing quotes as in `" WHERE ".$db->escape($value)." OR "`. * Qual: Fix code for SqlInjection analysis # Qual: Fix code for SqlInjection analysis Rewrite some escape calls, change escape() in sanitize(), rename variable, ignore SqlInjection notices. * Qual: Update baseline Allow some SqlInjection* notices, to be fixed later or already fixed in develop. |
||
|---|---|---|
| .. | ||
| CellFixer.php | ||
| DeprecatedModuleNameFixer.php | ||
| ifsqlFixer.php | ||
| MultiCellFixer.php | ||
| NoVarDumpPlugin.php | ||
| ParamMatchRegexPlugin.php | ||
| PriceFormFixer.php | ||
| SelectDateFixer.php | ||
| setAutoPageBreakFixer.php | ||
| setPageOrientationFixer.php | ||
| SqlInjectionPlugin.php | ||
| textwithpictoFixer.php | ||
| UrlEncodeStringifyFixer.php | ||