diff --git a/src/Psalm/Internal/Analyzer/Statements/Expression/BinaryOpAnalyzer.php b/src/Psalm/Internal/Analyzer/Statements/Expression/BinaryOpAnalyzer.php index f761a6a8e2f..34a46992266 100644 --- a/src/Psalm/Internal/Analyzer/Statements/Expression/BinaryOpAnalyzer.php +++ b/src/Psalm/Internal/Analyzer/Statements/Expression/BinaryOpAnalyzer.php @@ -378,6 +378,7 @@ public static function addDataFlow( && $stmt instanceof PhpParser\Node\Expr\BinaryOp && !$stmt instanceof PhpParser\Node\Expr\BinaryOp\Concat && !$stmt instanceof PhpParser\Node\Expr\BinaryOp\Coalesce + && (!$stmt instanceof PhpParser\Node\Expr\BinaryOp\Plus || !$result_type->hasArray()) ) { //among BinaryOp, only Concat and Coalesce can pass tainted value to the result return; diff --git a/tests/TaintTest.php b/tests/TaintTest.php index 5bbd74ec3b5..5cbbcb7b69b 100644 --- a/tests/TaintTest.php +++ b/tests/TaintTest.php @@ -650,6 +650,12 @@ function takesArray(array $arr): void { $var = $input === "x"; var_dump($var);' ], + 'resultOfPlusIsNotTainted' => [ + ' "good"]);', 'error_message' => 'TaintedHtml', ], + 'resultOfPlusIsTaintedOnArrays' => [ + ' 'TaintedHtml', + ], 'taintArrayKeyWithExplicitSink' => [ '