feat(php): improve input sanitizer (#257)

Bearer · Feb 12, 2024 · f572b83 · f572b83
1 parent 7a20965
commit f572b83
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 0 deletions.
diff --git a/rules/php/shared/lang/user_input_sanitizer.yml b/rules/php/shared/lang/user_input_sanitizer.yml
@@ -2,6 +2,7 @@ type: shared
 languages:
   - php
 patterns:
+  - (int)$<_>
   - count($<_>)
   - filter_var($<!>$<_>$<...>)
 metadata:

diff --git a/tests/php/lang/raw_html_using_user_input/testdata/ok.php b/tests/php/lang/raw_html_using_user_input/testdata/ok.php
@@ -5,3 +5,5 @@
 $html = "<h1>{$_GET['x'] * $_GET['y']}</h1>";
 
 $html = "<h1>{$ok}</h1>";
+$foo = (int)$_GET['x']
+$html = "<h1>{$foo}</h1>";
diff --git a/tests/php/lang/raw_output_using_user_input/testdata/echo.php b/tests/php/lang/raw_output_using_user_input/testdata/echo.php
@@ -21,6 +21,7 @@
 echo "<h1>" . filter_var($_GET["ok"], FILTER_SANITIZE_STRING) . "</h1>";
 echo strip_tags($_GET["ok"]);
 echo $_GET["x"] + $_GET["y"];
+echo (int)$_GET["x"];
 
 // FIXME: Add support for $this
 $this->Oops = $_POST["oops"];