Replies: 37 comments 10 replies
-
|
Hey @klebann, can you reproduce the issue on https://psalm.dev ? |
Beta Was this translation helpful? Give feedback.
-
|
Hey! Take a look at this: Your plugin should have the same beggining. Once you get to method_storage , you can dump it to take a look at it, it should be a good beggining. |
Beta Was this translation helpful? Give feedback.
-
|
How can i disable all errors from vendor/bin/psalm output and display only this from my plugin? They are useless in my project: |
Beta Was this translation helpful? Give feedback.
-
|
I think the easiest way would be to create a psalm-plugin.xml file that suppresses every native issue in psalm. This is not very easy right now (I think the only solution would be to make an issueHandler with each issue and suppress them one by one. (Maybe this could be a PR to submit to allow suppressing every native issue with a config, or maybe a level 99) Once you have your own psalm-plugin.xml created this way, you launch |
Beta Was this translation helpful? Give feedback.
-
|
@orklah every issue like so?
|
Beta Was this translation helpful? Give feedback.
-
|
The list of all supported issues can be found here: Lines 182 to 186 in a27c674 |
Beta Was this translation helpful? Give feedback.
-
|
@klebann yeah, exactly @weirdan thanks for the link, I didn't thought of linking the xsd :) |
Beta Was this translation helpful? Give feedback.
-
|
I muted all issues from https://psalm.dev/docs/running_psalm/issues/ |
Beta Was this translation helpful? Give feedback.
-
|
Which API interface should I use to find usuage of $DB->get_record_sql( ... ) and then validate arguments of this specific function? A usage example would be welcome! AfterEveryFunctionCallAnalysisInterface would be good for this? |
Beta Was this translation helpful? Give feedback.
-
|
You should already receive every call to get_record_sql in afterMethodCallAnalysis. in my plugin, By navigating I don't know of any plugin who do exactly that though, so you'll have to do some tweaking on your own. If you're stuck, just ask, we'll answer when we can 😄 |
Beta Was this translation helpful? Give feedback.
-
|
Yes, but I dumped all
unluckily... |
Beta Was this translation helpful? Give feedback.
-
|
After all, psalm is not able to scan whole Moodle code, it shows error during |
Beta Was this translation helpful? Give feedback.
-
|
Can you please explain in length exactly what you want to do? I don't get why you would want Psalm to analyze the library (instead of your own code calling the library) |
Beta Was this translation helpful? Give feedback.
-
|
I only have this in my code: I want to find all usuage of function |
Beta Was this translation helpful? Give feedback.
-
|
So the code you copy/pasted do exactly that. It will send you an $expr object that represents This $expr object can be navigated (it's a PHP-Parser node) to find everything in the expression (the method name, the params). Psalm will then help you identify the types for everything (for example, the $sql type and $params type) EDIT: you shouldn't analyse the moodle library, only your own code. Psalm will retrieve and analyse what it needs in your dependancies |
Beta Was this translation helpful? Give feedback.
-
|
$DB is defined in moodle library, in plugin you only use it as global object. Adding definition of The plugin am I working with is only an example. It's not even mine. I just want to analyse the code of plugins for security reasons. Checking arguments is another step. If you are intrested, I wan't to check if this function uses Placeholders So function get_record_sql is potentialy dangerous. I want to make sure that author of plugin is using Placeholders for arguments in this method. This will prevent SQL-injection. |
Beta Was this translation helpful? Give feedback.
-
|
Ok, I see, but if you have access to psalm-plugin.xml to suppress issues, what's preventing you to add the type in it anyway? Anyway, if you don't want to, there are two more solutions that I can see:
|
Beta Was this translation helpful? Give feedback.
-
|
Hmm, I may be wrong on the second option. If the argument is a variable and not directly a literal in situ, you'll be stuck if you use only Php-Parser. Psalm on the other hand will have propagated the content from variable to variable to be able to tell you what's inside. |
Beta Was this translation helpful? Give feedback.
-
Because I can add psalm-plugin.xml to any moodle plugin. This can be just downloaded and used. Code can be diferend in many cases and I'm not intrested in finding manually every usuage of global $DB and adding comment there.
That's the reason why I want to use Psalm. Argument can be a variable. I writed phpgrep function for searching all usages of $DB->...sql...(...) in code: |
Beta Was this translation helpful? Give feedback.
-
|
Can't this be done with appropriate stubs and Psalm's taint analysis? The thing you're trying to do looks quite similar as far as I can see. |
Beta Was this translation helpful? Give feedback.
-
Please re-read this:
|
Beta Was this translation helpful? Give feedback.
-
|
Okey, I added: Then I added: Now I'm able to find all get_records_sql() methods. But how to do the same without adding this extra moodle_database class, the definition of this class is in .../lib/setup.php, strictly speaking in moodle files. Is that possible? |
Beta Was this translation helpful? Give feedback.
-
|
You shouldn't need to add the class yourself. I added it because it was absent from your repo. You just have to ensure psalm is able to find the class somehow. This is usually done with autoloading, documentation should tell you more about this if autoloading does not work for you |
Beta Was this translation helpful? Give feedback.
-
|
Is this correct? Seems like it is working |
Beta Was this translation helpful? Give feedback.
-
|
I'd have said it can't work because your require is made after the return, but PHP must require your file (and include it in its known classes) before executing the return, I learned something new 😄 It seems to work well, now you should be able to dump $expr to see what's inside. Just remember $expr comes from PHP-Parser so it doesn't include types from Psalm. You'll have to retrieve the types once you identify what you need in $expr |
Beta Was this translation helpful? Give feedback.
-
|
Beware, if you want to include your psalm-autoloader in any project, the composer class name is random so it won't match. I don't know how composer really works but you should be able to still use it somehow |
Beta Was this translation helpful? Give feedback.
-
At this moment I'm able to check type of first parametr and parse it to string for differend cases! 👍🏻e.g. Unfortunetly, now I slammed with a problem.e. g. I can parse whole first parameter of How can I using psalm get implementation line of variable $fields into string like so? Maybe is there another tool that can help me? Thanks for all the answers so far, I hope that together we will be able to make a functional plugin for the Psalm. 😄 |
Beta Was this translation helpful? Give feedback.
-
|
I'm not sure I undersood what you want. If I'm correct, you need to fetch the string content of BinaryOp\Concat using PHP-Parser. You should just have to identify the right part and then use Psalm to get it's type |
Beta Was this translation helpful? Give feedback.
-
|
Or another example from docs.moodle.org:
(I'm here now)
|
Beta Was this translation helpful? Give feedback.
-
|
To me it sounds like what you actually need is a custom string subtype, something like Try the following:
This will probably allow you to get what you want as long as |
Beta Was this translation helpful? Give feedback.
-
|
@weirdan Could you tell me more about how to make this? I was trying but you can help me make this faster. I crated empty final class ReturnTypeProvider implements MethodReturnTypeProviderInterface
{
/**
* @return array<string>
*/
public static function getClassLikeNames(): array
{
return [TMoodleSqlCriteriaString::class];
}
public static function getMethodReturnType(StatementsSource $source, string $fq_classlike_name, string $method_name_lowercase, array $call_args, Context $context, CodeLocation $code_location, array $template_type_parameters = null, string $called_fq_classlike_name = null, string $called_method_name_lowercase = null)
{
echo "hello";
}
}now how to tell variable created by |
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
Thanks @weirdan now I was able to make this! |
Beta Was this translation helpful? Give feedback.
-
|
There is another problem.. $statuses = ['todo', 'open', 'inprogress', 'intesting'];
list($insql, $inparams) = $DB->get_in_or_equal($statuses);
$sql5 = "SELECT * FROM {bugtracker_issues} WHERE status $insql";
$bugs = $DB->get_records_sql($sql5, $inparams);Warning: Unknown type of $sql5
Psalm\Type\Union Object
(
[types:Psalm\Type\Union:private] => Array
(
[string] => Psalm\Type\Atomic\TNonEmptyString Object
(
[checked] =>
[from_docblock] =>
[offset_start] =>
[offset_end] =>
[text] =>
)
)My psalm plugin recognises this as TNonEmptyString, and ass seen above, this object is empty. How can i get from this value of text = "SELECT * FROM {bugtracker_issues} WHERE status"? if my code looks like this: $bugs = $DB->get_records_sql("SELECT * FROM {bugtracker_issues} WHERE status $insql", $inparams);then my psalm plugin knows that there is Scalar_encapsed and can get values from it. But in first example I don't see any values in |
Beta Was this translation helpful? Give feedback.
-
Hello,
I want to use psalm to find only specific functions in my code and validate arguments.
I was trying to make custom plugin for this but I don't have clue how to write new rule.
I added empty template of plugin to psalm and it doesn't work:
Can somebody show me an example of simple plugin for this purpose or tell me how to make this?
To be more specific, i want to search for $DB->...sql...( ) usage and then validate arguments in this method.
Beta Was this translation helpful? Give feedback.
All reactions