Add mysqli::query as a taint sink

[craigfrancis]

While this issue is detected:

<?php
$mysqli = new mysqli('localhost', 'test', '???', 'test');
$result = mysqli_query($mysqli, 'SELECT * FROM user WHERE id = ' . $_GET['id']);
?>

This one is not:

<?php
$mysqli = new mysqli('localhost', 'test', '???', 'test');
$result = $mysqli->query('SELECT * FROM user WHERE id = ' . $_GET['id']);
?>

[psalm-github-bot]

Hey @craigfrancis, can you reproduce the issue on https://psalm.dev ?

[craigfrancis]

https://psalm.dev/r/a92254e11d
https://psalm.dev/r/fcf2f09014

[psalm-github-bot]

I found these snippets:

https://psalm.dev/r/a92254e11d

<?php // --taint-analysis
$mysqli = new mysqli('localhost', 'test', '???', 'test');
$result = mysqli_query($mysqli, 'SELECT * FROM user WHERE id = ' . $_GET['id']);
?>

Psalm output (using commit 29efab5):

ERROR: TaintedInput - 3:33 - Detected tainted sql

https://psalm.dev/r/fcf2f09014

<?php // --taint-analysis
$mysqli = new mysqli('localhost', 'test', '???', 'test');
$result = $mysqli->query('SELECT * FROM user WHERE id = ' . $_GET['id']);
?>

Psalm output (using commit 29efab5):

No issues!

[muglug]

@craigfrancis you should be able to PR this, making a change to InternalTaintSinkMap.php