From 3d2600b0399af0dd4521469725f5e4bdf348bd2e Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Thu, 20 Jul 2017 22:48:13 +0200 Subject: Add Phan plugin to check for SQL injections This adds a phan plugin which checks for SQL injections on code using our QueryBuilder, while it isn't perfect it should already catch most potential issues. As always, static analysis will sometimes have false positives and this is also here the case. So in some cases the analyzer just doesn't know if something is potential user input or not, thus I had to add some `@suppress SqlInjectionChecker` in front of those potential injections. The Phan plugin hasn't the most awesome code but it works and I also added a file with test cases. Signed-off-by: Lukas Reschke --- lib/private/Setup/PostgreSQL.php | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'lib/private/Setup') diff --git a/lib/private/Setup/PostgreSQL.php b/lib/private/Setup/PostgreSQL.php index 18ed9fcdef6..8267b065142 100644 --- a/lib/private/Setup/PostgreSQL.php +++ b/lib/private/Setup/PostgreSQL.php @@ -34,6 +34,11 @@ use OCP\IDBConnection; class PostgreSQL extends AbstractDatabase { public $dbprettyname = 'PostgreSQL'; + /** + * @param string $username + * @throws \OC\DatabaseSetupException + * @suppress SqlInjectionChecker + */ public function setupDatabase($username) { try { $connection = $this->connect([ -- cgit v1.2.3