Add Psalm taint annotations for session/cookie security

src/Annotation/Cookie.php

@@ -7,7 +7,8 @@
 use Attribute;
 use Ray\Di\Di\Qualifier;
 
-#[Attribute, Qualifier]
+#[Attribute]
+#[Qualifier]
 final class Cookie
 {
 }

src/Annotation/DeleteCookie.php

@@ -7,7 +7,8 @@
 use Attribute;
 use Ray\Di\Di\Qualifier;
 
-#[Attribute, Qualifier]
+#[Attribute]
+#[Qualifier]
 final class DeleteCookie
 {
 }

src/AuraSessionInject.php

@@ -6,15 +6,13 @@
 
 use Aura\Session\Session;
 
-/**
- * @deprecated Use PHP 8.0: Class constructor property promotion instead
- */
+/** @deprecated Use PHP 8.0: Class constructor property promotion instead */
 trait AuraSessionInject
 {
     /** @var Session */
     protected $session;
 
-    public function setSession(Session $session)
+    public function setSession(Session $session): void
     {
         $this->session = $session;
     }

src/AuraSessionModule.php

@@ -22,7 +22,7 @@
 class AuraSessionModule extends AbstractModule
 {
     /**
-     * {@inheritdoc}
+     * {@inheritDoc}
      */
     protected function configure()
     {

src/CookieProvider.php

@@ -13,9 +13,10 @@
 class CookieProvider implements ProviderInterface
 {
     /**
-     * {@inheritdoc}
+     * {@inheritDoc}
      *
      * @SuppressWarnings(PHPMD.Superglobals)
+     * @psalm-taint-source input
      */
     public function get()
     {

src/DeleteCookieInvoker.php

@@ -8,11 +8,10 @@
 
 namespace Ray\AuraSessionModule;
 
-use function setcookie;
-use function time;
-
 final class DeleteCookieInvoker
 {
+    public const EXPIRE_OFFSET = 42000;
+
     /**
      * Delete a cookie by setting its expiration time to a past value
      *
@@ -23,9 +22,9 @@ public function __invoke(string $name, array $params): void
         setcookie(
             $name,
             '',
-            time() - 42000,
+            time() - self::EXPIRE_OFFSET,
             $params['path'],
-            $params['domain']
+            $params['domain'],
         );
     }
 }

src/SessionProvider.php

@@ -1,26 +1,27 @@
 <?php
+
+declare(strict_types=1);
+
 /**
  * This file is part of the Ray.AuraSessionModule package.
- *
- * @license http://opensource.org/licenses/MIT MIT
  */
+
 namespace Ray\AuraSessionModule;
 
 use Aura\Session\SessionFactory;
 use Ray\Di\ProviderInterface;
 
-/**
- * @deprecated
- */
+/** @deprecated */
 class SessionProvider implements ProviderInterface
 {
     /**
-     * {@inheritdoc}
+     * {@inheritDoc}
      *
      * @SuppressWarnings(PHPMD.Superglobals)
+     * @psalm-taint-source input
      */
     public function get()
     {
-        return (new SessionFactory)->newInstance($_COOKIE);
+        return (new SessionFactory())->newInstance($_COOKIE);
     }
 }

tests/AuraSessionInjectTest.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Ray\AuraSessionModule;
+
+use Aura\Session\Session;
+use PHPUnit\Framework\TestCase;
+
+class FakeSessionConsumer
+{
+    use AuraSessionInject;
+
+    public function getSession(): Session
+    {
+        return $this->session;
+    }
+}
+
+class AuraSessionInjectTest extends TestCase
+{
+    public function testSetSession(): void
+    {
+        $session = $this->createMock(Session::class);
+        $consumer = new FakeSessionConsumer();
+        $consumer->setSession($session);
+
+        $this->assertSame($session, $consumer->getSession());
+    }
+}

tests/DeleteCookieInvokerTest.php

@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Ray\AuraSessionModule;
+
+use PHPUnit\Framework\TestCase;
+
+/** @var array<int, array{name: string, value: string, expires: int, path: string, domain: string}> */
+$setCookieCalls = [];
+
+/**
+ * Override time function for testing
+ */
+function time(): int
+{
+    return 1000000;
+}
+
+/**
+ * Override setcookie function for testing
+ *
+ * @return bool
+ */
+function setcookie(string $name, string $value = '', int $expires = 0, string $path = '', string $domain = '')
+{
+    global $setCookieCalls;
+
+    $setCookieCalls[] = [
+        'name' => $name,
+        'value' => $value,
+        'expires' => $expires,
+        'path' => $path,
+        'domain' => $domain,
+    ];
+
+    return true;
+}
+
+class DeleteCookieInvokerTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        global $setCookieCalls;
+
+        $setCookieCalls = [];
+    }
+
+    public function testInvoke(): void
+    {
+        global $setCookieCalls;
+
+        $invoker = new DeleteCookieInvoker();
+        $invoker('test_cookie', ['path' => '/app', 'domain' => 'example.com']);
+
+        $this->assertCount(1, $setCookieCalls);
+        $this->assertSame('test_cookie', $setCookieCalls[0]['name']);
+        $this->assertSame('', $setCookieCalls[0]['value']);
+        $this->assertSame(1000000 - DeleteCookieInvoker::EXPIRE_OFFSET, $setCookieCalls[0]['expires']);
+        $this->assertSame('/app', $setCookieCalls[0]['path']);
+        $this->assertSame('example.com', $setCookieCalls[0]['domain']);
+    }
+}

tests/SessionProviderTest.php

@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Ray\AuraSessionModule;
+
+use Aura\Session\Session;
+use PHPUnit\Framework\TestCase;
+
+class SessionProviderTest extends TestCase
+{
+    public function testGet(): void
+    {
+        $provider = new SessionProvider();
+        $session = $provider->get();
+        $this->assertInstanceOf(Session::class, $session);
+    }
+}