[danog]

Adds Psalm taint analysis annotations, so that Psalm follows untrusted data through php-vips in the projects that use it:

• The files Image::newFromFile() reads and Image::writeToFile() writes are file sinks.

These are docblock-only changes, with no effect at runtime or on other tools. Psalm currently ships them as a stub for this library (vimeo/psalm#12466); having them here keeps them in step with the code.

[jcupitt]

Hi @danog,

This sounds useful.

There are other sources and sinks, for example .newFromBuffer() (used on eg. a JPEG formatted image that has been loaded into memory) or .avg() (an image sink that computes the pixel average).

Does Psalm consider objects other than files?

[danog]

Thanks! Psalm's taint analysis follows untrusted values (request parameters, uploaded data, …) into places where they could be injected: file paths, shell commands, SQL, HTML, URLs requested, and so on. A sink there is a parameter whose value is interpreted as one of those.

• newFromBuffer() takes the image bytes themselves, not a path or a command, so there's nothing to inject: decoding untrusted image data is libvips' job, not a taint issue Psalm models.
• avg() returns a number, which Psalm treats as unable to carry those taints, so it's neither a source nor a sink.

There were a few more methods taking a path that I'd missed, though, so I've added file sinks to Image::findLoad(), Source::newFromFile() and Target::newToFile().

The generated loaders and savers (jpegload(), csvsave(), …) also take filenames, but they are @method magic methods, which Psalm can't attach taint annotations to.

[danog]

Unless you'd be okay with adding a custom taint type for image decoding, but I feel that's a bit overkill

[jcupitt]

Sure, let's merge. Would you like to add yourself to the changelog? Something like:

- add psalm taint hints [danog]

[danog]

Done!

[jcupitt]

Great! Thank you for this useful improvement, @danog