upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-04-26 08:38:11 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 30

fix: Fix false-positive psalm taint errors when outputting plain text

Browse source 
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
This commit is contained in:
Côme Chilliet 2025-02-17 15:00:58 +01:00
parent 7c907223d2
commit 640dbd0b5e
No known key found for this signature in database
GPG key ID: A3E2F658B28C760A
2 changed files with 10 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
build/psalm-baseline-security.xml
View file

@ -36,14 +36,6 @@
<code><![CDATA[$sqliteFile]]></code>
</TaintedFile>
</file>
<file src="lib/private/legacy/OC_Template.php">
<TaintedHtml>
<code><![CDATA[$exception->getTraceAsString()]]></code>
</TaintedHtml>
<TaintedTextWithQuotes>
<code><![CDATA[$exception->getTraceAsString()]]></code>
</TaintedTextWithQuotes>
</file>
<file src="lib/public/DB/QueryBuilder/IQueryBuilder.php">
<TaintedSql>
<code><![CDATA[$column]]></code>

12
lib/private/legacy/OC_Template.php
View file

@ -313,7 +313,15 @@ class OC_Template extends \OC\Template\Base {
die();
}
private static function printPlainErrorPage(\Throwable $exception, bool $debug = false) {
/**
* @psalm-taint-escape has_quotes
* @psalm-taint-escape html
*/
private static function fakeEscapeForPlainText(string $str): string {
return $str;
}
private static function printPlainErrorPage(\Throwable $exception, bool $debug = false): void {
header('Content-Type: text/plain; charset=utf-8');
print("Internal Server Error\n\n");
print("The server encountered an internal error and was unable to complete your request.\n");
@ -323,7 +331,7 @@ class OC_Template extends \OC\Template\Base {
if ($debug) {
print("\n");
print($exception->getMessage() . ' ' . $exception->getFile() . ' at ' . $exception->getLine() . "\n");
print($exception->getTraceAsString());
print(self::fakeEscapeForPlainText($exception->getTraceAsString()));
}
}
}