Follow the taints of Twig template values through filters, keys, includes and conditions

[danog]

Follows #390. Replaces #391, whose commit comes first here. Found while enabling taint analysis on a large codebase, where most template variables are arrays or objects with a few tainted keys.

What a filter or function returns (was #391)

A Twig filter is PHP code, but the taint analysis passed what it is given through to what it returns, whatever it does. A custom escaping filter ({{ name|esc|raw }}, with esc calling htmlspecialchars() and declaring @psalm-taint-escape html) was reported like {{ name|raw }}, and so was a filter returning a number ({{ items|length|raw }}).

What a filter or function returns now takes the taints of what it is given (its arguments too: {{ 'Hello %s'|format(name)|raw }}), but those its PHP callable removes: those its storage says it escapes (@psalm-taint-escape), and those its native return type cannot hold (int for length). The callable is the one Twig resolves, also for a filter whose name matches a pattern (*_escape): a function, a Class::method string, a [class, method] array, or a first-class callable. A closure, or a callable Psalm does not know, removes nothing.

Values followed by key

The taints of a template value were followed as a whole. Now they follow the array paths Psalm uses in PHP, so a key only has the taints put in that key:

• each variable of a template is given, by key, the parameter of its name of each render() call. Before, every variable had the taints of all of the template's parameters; and the parameters of a call reached the templates of other calls, as they went through the parameter node of render(), which all calls share;
• an attribute with a constant name (item.name, item['name']) is fetched by key. A method call (item.name()) or an attribute with a computed name still takes the taints of the whole value and of the arguments;
• a for loop gives its key through an arraykey-fetch path and its value through an arrayvalue-fetch path.

Each variable has its own node: Psalm follows a single flow of given taints through a node, so if the parameters of a template shared one, they would all leave by the key of the first. That is also why $arr['y'] isn't reported for $arr = ['x' => $_GET['a'], 'y' => $_GET['b']]; echo $arr['y']; in plain PHP: an issue of Psalm, not of this plugin.

Includes, control flow

• An included template is given every variable it reads, also those it sets ({% set title = title|default('x') %}), and those read by the templates it gives its context to, however deep.
• include with a variable (with vars), the include() function, embed (and the blocks it overrides) and extends give their context and display what the template outputs.
• A variable set in an if or a for can keep the value it had, and a loop variable gets back its value after the loop.
• The nodes of a line of a template are told apart: two expressions of a line no longer share their taints.

Tests: 17 new scenarios in TwigTaintingWithAnalyzer.feature. The 2 of #391, the 3 of the keyed values, and 14 of the 15 for the rest (all but "An embedded template only given its own variables does not display a tainted parameter") fail without this change. phpunit (45 tests), codecept run -g symfony-common (129 tests) and psalm --find-dead-code --find-unused-psalm-suppress pass.