open-dxp / psalm-plugin
Psalm knows where OpenDXP takes SQL and serialized data, and reports untrusted input that reaches it.
Requires
- php: ~8.3.0 || ~8.4.0 || ~8.5.0
- vimeo/psalm: ^7.0
Requires (Dev)
- open-dxp/opendxp: ^1.4
- pestphp/pest: ^4.7
Suggests
None
Provides
None
Conflicts
- open-dxp/opendxp: >=2.0
Replaces
None
This package is auto-updated.
Last update: 2026-11-05 09:54:30 UTC
README
Psalm follows untrusted input, such as a request parameter, through the code and reports where it reaches a sink: a place where it is run as SQL, unserialized or written into HTML. Psalm knows the sinks of PHP, and plugins add those of a framework. This plugin adds the sinks of OpenDXP.
composer require --dev open-dxp/psalm-plugin
vendor/bin/psalm-plugin enable open-dxp/psalm-plugin
A Symfony application needs psalm/plugin-symfony as well. Without it, Psalm does not know that a request carries untrusted input.
Sinks
| Method | Takes |
|---|---|
setCondition() and addConditionParam() of listings |
SQL |
OpenDxp\Tool\Serialize::unserialize() |
serialized PHP |
The query methods of Db::get() |
SQL |
where() and having() of the DBAL query builder |
SQL |
weirdan/doctrine-psalm-plugin declares
executeStatement() and a few other methods of DBAL. This plugin declares the rest, such as
fetchAllAssociative() and executeQuery().
A value bound as a parameter never reaches the SQL, so Psalm reports nothing for it:
$listing->setCondition('id = ?', [$request->query->get('id')]);
Run the taint analysis in CI
The OpenDXP workflows run the analysis with this plugin for a bundle or a project.