nextcloud

ツリー: bb352fb667

Morris Jobke 1f06bc246c Declare func() as safe method in phan We added a special `func()` method to the query builder, which is a plain text function by definition. It uses the string and does no escaping on purpose. It has the potential for an injection but requiring to add the "supress warning" to all surrounding code makes it harder to spot actual problems, that this plugin want to find. So it's better to only need to check the func() and not all the surrounding code as well. Signed-off-by: Morris Jobke <hey@morrisjobke.de>	6年前
..
SqlInjectionCheckerPlugin.php	Declare func() as safe method in phan	6年前

Declare func() as safe method in phan

We added a special `func()` method to the query builder, which is a plain text function by definition. It uses the string and does no escaping on purpose. It has the potential for an injection but requiring to add the "supress warning" to all surrounding code makes it harder to spot actual problems, that this plugin want to find. So it's better to only need to check the func() and not all the surrounding code as well.

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

6年前

SqlInjectionCheckerPlugin.php

Declare func() as safe method in phan

6年前