Added event to prevent tainting.

[mortenson]

Per #5382 this PR adds a new event that allows plugins to prevent tainting in specific scenarios. I've also added an example plugin/test that shows how you can inspect the structure of an array to determine if it should be considered a taint source.

This is a WIP, so let me know if you want the event name or test changed - once that's decided I can dispatch the event from more analyzers if you'd like.

[muglug]

Ok, extra complication: I think this plugin should instead inform these two arguments:

psalm/src/Psalm/Internal/Codebase/DataFlowGraph.php

Lines 30 to 31 in dd4d970

	?array $added_taints = null,
	?array $removed_taints = null

in the call here:

psalm/src/Psalm/Internal/Analyzer/Statements/Expression/ArrayAnalyzer.php

Line 371 in df43126

$data_flow_graph->addPath(

It may be the case that you want to remove the html taint but preserve the sql taint, for example. In this case you'd want to remove html taints.

So instead of being a boolean I think it wants to provide two separate arrays of added and removed taints at every node it's used on. If both those arrays are empty there's no net effect

[muglug]

I've updated the PR along those lines! The main benefit is it allows people to institute their own custom taints in a smarter fashion.

[mortenson]

@muglug That looks good to me - the test I added still works as expected so I think this would give me a path forward on the render array problem. Would you like me to rename the new test method and add this event dispatch to other analyzers? (If you have time to do this don't wait on me though)

[muglug]

Would you like me to rename the new test method and add this event dispatch to other analyzers?

That would be great!

[mortenson]

@muglug StaticCallAnalyzer, AtomicPropertyFetchAnalyzer, and ArrayFetchAnalyzer didn't have access to Context which is needed for this event, should I add $context as an optional parameter to the relevant public static methods on those classes?

All other analyzers that used that TaintedInput check you mentioned in the issue have been updated.

[mortenson]

I did the above, feel free to clean up the new event invocations/calls as needed.

[muglug]

Thanks, this is a great effort

[mortenson]

Thank you @muglug !