From 24137bdbadcbda53aff10b5d01b02d1c59949c55 Mon Sep 17 00:00:00 2001
From: orklah <ronan_morin@hotmail.com>
Date: Wed, 3 Nov 2021 21:11:06 +0100
Subject: [PATCH] Array cast pass taints

---
 .../Analyzer/Statements/Expression/CastAnalyzer.php    |  3 +--
 tests/TaintTest.php                                    | 10 ++++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/Psalm/Internal/Analyzer/Statements/Expression/CastAnalyzer.php b/src/Psalm/Internal/Analyzer/Statements/Expression/CastAnalyzer.php
index 545aebfc279..e6dc20960fb 100644
--- a/src/Psalm/Internal/Analyzer/Statements/Expression/CastAnalyzer.php
+++ b/src/Psalm/Internal/Analyzer/Statements/Expression/CastAnalyzer.php
@@ -232,8 +232,7 @@ public static function analyze(
                 $type = Type::getArray();
             }
 
-            if ($statements_analyzer->data_flow_graph instanceof \Psalm\Internal\Codebase\VariableUseGraph
-            ) {
+            if ($statements_analyzer->data_flow_graph) {
                 $type->parent_nodes = $stmt_expr_type->parent_nodes ?? [];
             }
 
diff --git a/tests/TaintTest.php b/tests/TaintTest.php
index f7e74b93f29..f36dd80b462 100644
--- a/tests/TaintTest.php
+++ b/tests/TaintTest.php
@@ -2182,6 +2182,16 @@ function foo(array $arr) : void {
                 'error_message' => 'TaintedHtml',
             ],
             */
+            'castToArrayPassTaints' => [
+                '<?php
+                    $args = $_POST;
+
+                    $args = (array) $args;
+
+                    pg_query($connection, "SELECT * FROM tableA where key = " .$args["key"]);
+                    ',
+                'error_message' => 'TaintedSql',
+            ],
         ];
     }