Add Psalm security checks (has_quotes only) and fix detected issues

* Add Psalm security checks (`has_quotes` only)

* Fix detected issues

* Add psalm command to makefile and test execution script

Author: cedric-anne

.github/workflows/security-scan.yml

@@ -0,0 +1,50 @@
+name: "Security scan"
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  security-scan:
+    name: "Security scan"
+    runs-on: "ubuntu-latest"
+    env:
+      COMPOSE_FILE: ".github/actions/docker-compose-app.yml"
+      APPLICATION_ROOT: "${{ github.workspace }}"
+      PHP_IMAGE: "githubactions-php-apache:8.4"
+      UPDATE_FILES_ACL: true
+    steps:
+      - name: "Set env"
+        run: |
+          echo "APP_CONTAINER_HOME=${{ runner.temp }}/app_home" >> $GITHUB_ENV
+      - name: "Checkout"
+        uses: "actions/checkout@v4"
+      - name: "Restore dependencies cache"
+        uses: actions/cache@v4
+        with:
+          path: |
+            ${{ env.APP_CONTAINER_HOME }}/.composer/cache/
+            ${{ env.APP_CONTAINER_HOME }}/.npm/_cacache/
+          key: "app_home_deps-${{ matrix.php-version }}-${{ hashFiles('composer.lock', 'package-lock.json') }}"
+          restore-keys: |
+            app_home_deps-${{ matrix.php-version }}-
+            app_home_deps-
+      - name: "Initialize containers"
+        run: |
+          .github/actions/init_containers-start.sh
+      - name: "Show versions"
+        run: |
+          .github/actions/init_show-versions.sh
+      - name: "Build dependencies / translations"
+        run: |
+          docker compose exec -T app .github/actions/init_build.sh
+      - name: "Psalm security scan"
+        run: |
+          docker compose exec -T app vendor/bin/psalm --long-progress --output-format=github

Makefile

@@ -149,6 +149,11 @@ phpstan-generate-baseline: c=--generate-baseline=.phpstan-baseline.php analyze
 phpstan-generate-baseline: phpstan
 .PHONY: phpstan-generate-baseline
 
+psalm: ## Run psalm analysis
+	@$(eval c ?=)
+	@$(PHP) php vendor/bin/psalm $(c)
+.PHONY: psalm
+
 ## —— Coding standards —————————————————————————————————————————————————————————
 phpcsfixer-check: ## Check for php coding standards issues
 	@$(PHP) vendor/bin/php-cs-fixer check --diff -vvv

ajax/asset/assetdefinition.php

@@ -54,10 +54,17 @@
         $v['id'] = $k;
         $field_results[] = $v;
     }
-    echo json_encode([
+
+    /**
+     * Safe JSON response.
+     * @psalm-taint-escape has_quotes
+     */
+    $response = json_encode([
         'results' => $field_results,
         'count' => count($all_fields),
     ], JSON_THROW_ON_ERROR);
+
+    echo $response;
     return;
 } elseif ($_REQUEST['action'] === 'get_core_field_editor') {
     header("Content-Type: text/html; charset=UTF-8");

ajax/dashboard.php

@@ -151,7 +151,14 @@
             throw new AccessDeniedHttpException();
         }
 
-        echo $dashboard->getFilter(); // `Dashboard::getFilter()` already returns a JSON encoded string.
+        /**
+         * `Dashboard::getFilter()` already returns a JSON encoded string.
+         *
+         * @psalm-taint-escape has_quotes
+         */
+        $filter = $dashboard->getFilter();
+
+        echo $filter;
         return;
 }
 

ajax/getDropdownNumber.php

@@ -40,4 +40,10 @@
 header("Content-Type: application/json; charset=UTF-8");
 Html::header_nocache();
 
-echo Dropdown::getDropdownNumber($_POST);
+/**
+ * Safe JSON response.
+ * @psalm-taint-escape has_quotes
+ */
+$response = Dropdown::getDropdownNumber($_POST, json: true);
+
+echo $response;

ajax/getDropdownUsers.php

@@ -40,4 +40,10 @@
 header("Content-Type: application/json; charset=UTF-8");
 Html::header_nocache();
 
-echo Dropdown::getDropdownUsers($_POST);
+/**
+ * Safe JSON response.
+ * @psalm-taint-escape has_quotes
+ */
+$response = Dropdown::getDropdownUsers($_POST, json: true);
+
+echo $response;

ajax/getDropdownValue.php

@@ -40,4 +40,10 @@
 header("Content-Type: application/json; charset=UTF-8");
 Html::header_nocache();
 
-echo Dropdown::getDropdownValue($_POST);
+/**
+ * Safe JSON response.
+ * @psalm-taint-escape has_quotes
+ */
+$response = Dropdown::getDropdownValue($_POST, json: true);
+
+echo $response;

composer.json

@@ -124,7 +124,8 @@
         "symfony/twig-bundle": "^6.4",
         "symfony/var-dumper": "^6.4",
         "symfony/web-profiler-bundle": "^6.4",
-        "thecodingmachine/phpstan-safe-rule": "^1.4"
+        "thecodingmachine/phpstan-safe-rule": "^1.4",
+        "vimeo/psalm": "^6.13"
     },
     "provide": {
         "ext-sodium": "*"