Commit Graph

14 Commits

Author SHA1 Message Date
Julius Härtl 8286f46ab9
Suppress psalm warnings about app classes
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2020-12-09 13:20:25 +01:00
Lukas Reschke 47ac8e0028
Add Psalm Taint Flow Analysis
This adds the Psalm Security Analysis, as described at
https://psalm.dev/docs/security_analysis/

It also adds a plugin for adding input into AppFramework.

The results can be viewed in the GitHub Security tab at
https://github.com/nextcloud/server/security/code-scanning

**Q&A:**

Q: Why do you not use the shipped Psalm version?
A: I do a lot of changes to the Psalm Taint behaviour. Using released
versions is not gonna get us the results we want.

Q: How do I improve false positives?
A: https://psalm.dev/docs/security_analysis/avoiding_false_positives/

Q: How do I add custom sources?
A: https://psalm.dev/docs/security_analysis/custom_taint_sources/

Q: We should run this on apps!
A: Yes.

Q: What will change in Psalm?
A: Quite some of the PHP core functions are not yet marked to propagate
the taint. This leads to results where the taint flow is lost. That's
something that I am currently working on.

Q: Why is the plugin MIT licensed?
A: Because its the first of its kind (based on GitHub Code Search) and
I want other people to copy it if they want to. Security is for all :)

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2020-11-20 23:12:00 +01:00
Arthur Schiwon 86e5e7d927
LDAP simplify User_Proxy and Group_Proxy signatures
- make User_Proxy and Group_Proxy easy to instantiate
- simplify dependent code
- move commands to info.xml
- make UpdateGroups job class non-static

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2020-10-23 12:25:31 +02:00
Morris Jobke b70792aa6a
Add stubs for gd, intl, IntlChar, ldap, redis_cluster and xsl
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2020-08-18 13:01:10 +02:00
Morris Jobke 4efca69f8d
Add psalm baseline
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2020-08-18 12:59:17 +02:00
Daniel Kesselberg 8d18f0a7d7
Suppress warning for template functions.
6e8e34fef9/lib/private/legacy/template/functions.php
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-08-18 08:58:20 +02:00
Daniel Kesselberg 90aa451447
Fix variable name for referenced variable.
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-08-18 08:58:20 +02:00
Daniel Kesselberg fe3a628470
Supress UndefinedGlobalVariable for register_command.php
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-08-18 08:58:20 +02:00
Daniel Kesselberg 568e1f6d3a
Remove directory/file element.
It will suppress any error of that kind in the file. That was not intended.

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-08-18 08:58:20 +02:00
Daniel Kesselberg 238f181dbf
Suppress warning for $_ and $l
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-08-18 08:58:20 +02:00
Daniel Kesselberg dd721fc5de
Fix: UndefinedFunction Function x does not exist in templates
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-08-18 08:58:19 +02:00
Daniel Kesselberg fd6cdbcb04
Add template functions
for some reason they are not loaded by default.

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-08-18 08:58:19 +02:00
Daniel Kesselberg 8b3b5ae5be
Add stubs for phpseclib
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-08-18 08:58:19 +02:00
Daniel Kesselberg 7257793fc4
Hello psalm
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-08-18 08:58:19 +02:00