HPB-4006 prevent unsafe request data

composer.json

@@ -6,7 +6,10 @@
     "license": "MIT",
     "autoload": {
         "psr-4": {
-            "Hihaho\\PhpstanRules\\": "src/"
+            "Hihaho\\PhpstanRules\\": "src/",
+            "Illuminate\\Foundation\\Http\\": "tests/stubs/Illuminate/Foundation/Http",
+            "App\\Http\\Controllers\\": "tests/stubs/App/Http/Controllers",
+            "App\\Http\\Requests\\": "tests/stubs/App/Http/Requests"
         }
     },
     "autoload-dev": {
@@ -23,7 +26,7 @@
     "minimum-stability": "stable",
     "require": {
         "php": "^8.2",
-        "phpstan/phpstan": "^1.10.55",
+        "phpstan/phpstan": "^1.11.0",
         "illuminate/support": "^10|^11",
         "laravel/pint": "^1.13.9"
     },

extension.neon

@@ -1,4 +1,12 @@
 services:
+    -
+        class: Hihaho\PhpstanRules\Rules\Validation\ScopeIlluminateRequestValidateMethods
+        tags:
+            - phpstan.rules.rule
+    -
+        class: Hihaho\PhpstanRules\Rules\Validation\ScopeFormRequestValidateMethods
+        tags:
+            - phpstan.rules.rule
     -
         class: Hihaho\PhpstanRules\Rules\NoInvadeInAppCode
         tags:

src/Rules/Validation/ScopeFormRequestValidateMethods.php

@@ -0,0 +1,72 @@
+<?php declare(strict_types=1);
+
+namespace Hihaho\PhpstanRules\Rules\Validation;
+
+use Illuminate\Foundation\Http\FormRequest;
+use PhpParser\Node;
+use PhpParser\Node\Expr\MethodCall;
+use PHPStan\Analyser\Scope;
+use PHPStan\Rules\RuleErrorBuilder;
+use PHPStan\ShouldNotHappenException;
+use ReflectionClass;
+use ReflectionException;
+
+final class ScopeFormRequestValidateMethods extends ScopeValidationMethods
+{
+    public function getNodeType(): string
+    {
+        return MethodCall::class;
+    }
+
+    /**
+     * @phpstan-param MethodCall $node
+     * @throws ReflectionException
+     * @throws ShouldNotHappenException
+     */
+    public function processNode(Node $node, Scope $scope): array
+    {
+        if (str_starts_with($scope->getNamespace(), 'App\\Http\\Request')) {
+            return [];
+        }
+
+        if (! $this->hasFormRequestClass($scope)) {
+            return [];
+        }
+
+        if ($this->usesValidMethod(varName: $this->nameFrom($node->var), methodName: $this->nameFrom($node))) {
+            return [];
+        }
+
+        return [
+            RuleErrorBuilder::message(
+                'Usage of unvalidated request data is not allowed outside of App\\Http\\Requests'
+            )
+                ->nonIgnorable()
+                ->tip('Use $request->safe() to use request data')
+                ->identifier('hihaho.request.unsafeRequestData')
+                ->build(),
+        ];
+    }
+
+    /** @throws ReflectionException */
+    private function hasFormRequestClass(Scope $scope): bool
+    {
+        $parentClassName = static fn (ReflectionClass $fqn) => $fqn->getParentClass()->getName();
+
+        return collect($this->getClassMethods($scope))
+            ->map(fn (array $method) => $this->getMethodParameterClassnames($method))
+            ->flatten()
+            ->map(fn (string $className) => new ReflectionClass($className))
+            ->filter(fn (ReflectionClass $className) => $parentClassName($className) === FormRequest::class)
+            ->isNotEmpty();
+    }
+
+    private function usesValidMethod(string $varName, string $methodName): bool
+    {
+        if ($varName === 'request' && ($methodName === 'safe' || $methodName === 'validated')) {
+            return true;
+        }
+
+        return $varName === 'safe' && $this->isValidateMethod($methodName);
+    }
+}

src/Rules/Validation/ScopeIlluminateRequestValidateMethods.php

@@ -0,0 +1,58 @@
+<?php declare(strict_types=1);
+
+namespace Hihaho\PhpstanRules\Rules\Validation;
+
+use Illuminate\Http\Request as IlluminateRequest;
+use PhpParser\Node;
+use PhpParser\Node\Expr\MethodCall;
+use PHPStan\Analyser\Scope;
+use PHPStan\Rules\RuleErrorBuilder;
+use PHPStan\ShouldNotHappenException;
+use ReflectionException;
+
+final class ScopeIlluminateRequestValidateMethods extends ScopeValidationMethods
+{
+    public function getNodeType(): string
+    {
+        return MethodCall::class;
+    }
+
+    /**
+     * @phpstan-param MethodCall $node
+     * @throws ShouldNotHappenException | ReflectionException
+     */
+    public function processNode(Node $node, Scope $scope): array
+    {
+        if (str_starts_with($scope->getNamespace(), 'App\\Http\\Request')) {
+            return [];
+        }
+
+        if (! $this->hasIlluminateRequestClass($scope)) {
+            return [];
+        }
+
+        if (! $this->isValidateMethod($this->nameFrom($node))) {
+            return [];
+        }
+
+        return [
+            RuleErrorBuilder::message(
+                'Usage of unvalidated request data is not allowed outside of App\\Http\\Requests'
+            )
+                ->nonIgnorable()
+                ->tip('Use $request->safe() to use request data')
+                ->identifier('hihaho.request.unsafeRequestData')
+                ->build(),
+        ];
+    }
+
+    /** @throws ReflectionException */
+    private function hasIlluminateRequestClass(Scope $scope): bool
+    {
+        return collect($this->getClassMethods($scope))
+            ->map(fn (array $method) => $this->getMethodParameterClassnames($method)
+                ->filter(fn (string $fqn) => $fqn === IlluminateRequest::class)
+            )
+            ->isNotEmpty();
+    }
+}

src/Rules/Validation/ScopeValidationMethods.php

@@ -0,0 +1,91 @@
+<?php declare(strict_types=1);
+
+namespace Hihaho\PhpstanRules\Rules\Validation;
+
+use Illuminate\Support\Collection;
+use Illuminate\Support\Stringable;
+use PhpParser\Node;
+use PhpParser\Node\Expr\MethodCall;
+use PhpParser\Node\Expr\Variable;
+use PhpParser\Node\Identifier;
+use PHPStan\Analyser\Scope;
+use PHPStan\Rules\Rule;
+use PHPStan\Type\ObjectType;
+use ReflectionClass;
+use ReflectionException;
+use ReflectionIntersectionType;
+use ReflectionMethod;
+use ReflectionNamedType;
+use ReflectionParameter;
+use ReflectionUnionType;
+
+/**
+ * @implements \PHPStan\Rules\Rule<\PhpParser\Node\Expr\MethodCall>
+ */
+abstract class ScopeValidationMethods implements Rule
+{
+    abstract public function getNodeType(): string;
+
+    abstract public function processNode(Node $node, Scope $scope): array;
+
+    /**
+     * @phpstan-return ReflectionMethod[]
+     * @throws ReflectionException
+     */
+    protected function getClassMethods(Scope $scope): array
+    {
+        $type = new ObjectType(className: $scope->getClassReflection()?->getName(), classReflection: $scope->getClassReflection());
+        /** @var ReflectionMethod[] $methods */
+        $methods = array_map(static function (string $className): array {
+            return (new ReflectionClass($className))->getMethods();
+        }, $type->getObjectClassNames());
+
+        return $methods;
+    }
+
+    protected function getMethodParameterClassnames(array $method): Collection
+    {
+        return collect($method)
+            ->map(fn (ReflectionMethod $method) => $method->getParameters())
+            ->map(fn (array $parameter) => array_map(static function (ReflectionParameter $parameter) {
+                /** @var ReflectionNamedType|ReflectionUnionType|ReflectionIntersectionType|null $type */
+                $type = $parameter->getType();
+
+                return $type?->getName();
+            }, $parameter))
+            ->flatten();
+    }
+
+    protected function nameFrom(MethodCall|Variable $var): string
+    {
+        if ($var->name instanceof Stringable) {
+            return $var->name->toString();
+        }
+
+        if ($var->name instanceof Identifier) {
+            return $var->name->toString();
+        }
+
+        return $var->name;
+    }
+
+    protected function isValidateMethod(string $methodName): bool
+    {
+        $methodNames = [
+            'collect',
+            'all',
+            'only',
+            'except',
+            'input',
+            'get',
+            'keys',
+            'string',
+            'str',
+            'integer',
+            'float',
+            'boolean',
+        ];
+
+        return in_array($methodName, $methodNames, strict: true);
+    }
+}

tests/Rules/Validation/ScopeFormRequestValidateMethodsTest.php

@@ -0,0 +1,30 @@
+<?php declare(strict_types=1);
+
+namespace Rules\Validation;
+
+use Hihaho\PhpstanRules\Rules\Validation\ScopeFormRequestValidateMethods;
+use PHPStan\Rules\Rule;
+use PHPStan\Testing\RuleTestCase;
+use PHPUnit\Framework\Attributes\Test;
+
+final class ScopeFormRequestValidateMethodsTest extends RuleTestCase
+{
+    protected function getRule(): Rule
+    {
+        return new ScopeFormRequestValidateMethods();
+    }
+
+    #[Test]
+    public function form_request_class_does_not_use_unvalidated_data_outside_its_namespace(): void
+    {
+        $this->analyse([__DIR__ . '/../../stubs/App/Http/Requests/UserRequest.php'], []);
+
+        $this->analyse([__DIR__ . '/../../stubs/App/Http/Controllers/PetControllerStub.php'], [
+            [
+                'Usage of unvalidated request data is not allowed outside of App\\Http\\Requests',
+                14,
+                'Use $request->safe() to use request data',
+            ],
+        ]);
+    }
+}

tests/Rules/Validation/ScopeIlluminateRequestValidateMethodTest.php

@@ -0,0 +1,52 @@
+<?php declare(strict_types=1);
+
+namespace Rules\Validation;
+
+use Hihaho\PhpstanRules\Rules\Validation\ScopeIlluminateRequestValidateMethods;
+use PHPStan\Analyser\Error;
+use PHPStan\Rules\Rule;
+use PHPStan\Testing\RuleTestCase;
+use PHPUnit\Framework\Attributes\Test;
+
+/**
+ * @extends RuleTestCase<ScopeIlluminateRequestValidateMethods>
+ */
+final class ScopeIlluminateRequestValidateMethodTest extends RuleTestCase
+{
+    protected function getRule(): Rule
+    {
+        return new ScopeIlluminateRequestValidateMethods();
+    }
+
+    #[Test]
+    public function illuminate_http_request_does_not_use_unvalidated_methods_outside_app_http_requests_namespace(): void
+    {
+        /** @var Error[] $errors */
+        $errors = $this->gatherAnalyserErrors([__DIR__ . '/../../stubs/App/Http/Controllers/PeopleControllerStub.php']);
+        $validErrors = array_filter(
+            $errors,
+            static fn (Error $error): bool => $error->getIdentifier() === 'hihaho.request.unsafeRequestData'
+        );
+        self::assertCount(6, $validErrors);
+
+        $unsafeRequestDataError = static fn (int $line) => [
+            'Usage of unvalidated request data is not allowed outside of App\\Http\\Requests',
+            $line,
+            'Use $request->safe() to use request data',
+        ];
+
+       $this->analyse([__DIR__ . '/../../stubs/App/Http/Controllers/PeopleControllerStub.php'], [
+            $unsafeRequestDataError(13),
+            $unsafeRequestDataError(14),
+            $unsafeRequestDataError(15),
+            $unsafeRequestDataError(16),
+            $unsafeRequestDataError(18),
+            $unsafeRequestDataError(21),
+            [
+                'No error with identifier method.notFound is reported on line 20.',
+                20,
+            ],
+        ]);
+
+    }
+}

tests/stubs/App/Http/Controllers/PeopleControllerStub.php

@@ -0,0 +1,41 @@
+<?php declare(strict_types=1);
+
+namespace App\Http\Controllers;
+
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+final class PeopleControllerStub
+{
+    public function __invoke(Request $request)
+    {
+        return new JsonResponse([
+            'first_name' => $request->input('first_name'),
+            'last_name' => $request->string('last_name'),
+            'age' => $request->integer('age'),
+            'has_children' => $request->boolean('has_children'),
+            'children' => [
+                'name' => $request->only(['name']),
+            ],
+            'email' => $request->safe()->email, // @phpstan-ignore method.notFound
+            'city' => $request->get('city'),
+        ]);
+    }
+
+    public function show(Request $request): JsonResponse
+    {
+        $data = $request->validate([]);
+
+        return new JsonResponse([
+            'first_name' => $data['first_name'],
+            'last_name' => $data['last_name'],
+            'age' => $data['age'],
+            'has_children' => $data['has_children'],
+            'children' => [
+                'name' => $data['name'],
+            ],
+            'email' => $data['email'],
+            'city' => $data['city'],
+        ]);
+    }
+}