Detection of Method Calls on Variables Created by Other Prior Method Calls

[paras-malhotra]

I'm working on improving some security static analysis on Enlightn. A lot of the rules check whether there is any request input in a certain method call.

Is it possible in PHPStan to detect method calls on primitive variables (such as strings, arrays) that were created by some specific method calls?

For instance, this code is currently detected by my Rule using isSuperTypeOf:

Model::forceCreate($request->all());

But I am currently unable to detect this:

$x = $request->all();
Model::forceCreate($x);

Note: $request->all() returns a simple array.

Is this possible using PHPStan? If so, I would really appreciate if you could point me in the right direction.

Thanks for the awesome package!

[ondrejmirtes]

Hi, you need to express this somehow using types. That way the built-in type inference in PHPStan will pick it up and you'll be able to track that across calls. The best way would be the Request::all() method to have some specific @return PHPDoc tag. Maybe generics would also help?

[paras-malhotra]

Thanks for your reply @ondrejmirtes! The Request object is of Laravel, and so I cannot change the PHPDoc. Should I build a type specifying extension or should I make stub files instead?

[ondrejmirtes]

Stub files is the way to go :)

[paras-malhotra]

Thanks so much @ondrejmirtes 👍