From e2bff39f736fabe8e150f1593ed2ea2c6cc2ea6b Mon Sep 17 00:00:00 2001 From: Robin Appelman Date: Thu, 22 Aug 2024 14:34:37 +0200 Subject: [PATCH] fix: mark systemconfig value as not being tainted because they are implicitly trusted Signed-off-by: Robin Appelman --- lib/private/SystemConfig.php | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/lib/private/SystemConfig.php b/lib/private/SystemConfig.php index f817e327b19..ed77526c29c 100644 --- a/lib/private/SystemConfig.php +++ b/lib/private/SystemConfig.php @@ -114,6 +114,24 @@ class SystemConfig { ) { } + /** + * Since system config is admin controlled, we can tell psalm to ignore any taint + * + * @psalm-taint-escape sql + * @psalm-taint-escape html + * @psalm-taint-escape ldap + * @psalm-taint-escape callable + * @psalm-taint-escape file + * @psalm-taint-escape ssrf + * @psalm-taint-escape cookie + * @psalm-taint-escape header + * @psalm-taint-escape has_quotes + * @psalm-pure + */ + public static function trustSystemConfig(mixed $value): mixed { + return $value; + } + /** * Lists all available config keys * @return array an array of key names @@ -150,7 +168,7 @@ class SystemConfig { * @return mixed the value or $default */ public function getValue($key, $default = '') { - return $this->config->getValue($key, $default); + return $this->trustSystemConfig($this->config->getValue($key, $default)); } /**