Force phan-taint-check to think LogFormatter stuff is safe for html
authorBrian Wolff <bawolff+wn@gmail.com>
Fri, 6 Jul 2018 13:47:39 +0000 (13:47 +0000)
committerBrian Wolff <bawolff+wn@gmail.com>
Sun, 8 Jul 2018 16:56:37 +0000 (16:56 +0000)
commit6b19444b32360d506a8166bb21c0b462e7eea462
tree8d0c853272b9e134f11bebc9b4a02d63bb02cc2e
parentc07b08b36c73e1f09d19ba384a0fe1e5b77852ba
Force phan-taint-check to think LogFormatter stuff is safe for html

Whether or not LogFormatter::getActionText() and friends are safe
for html depends on the runtime value of LogFormatter::$plaintext
which is beyond the abilities of phan-taint-check's static analysis
to determine. Thus this method results in a lot of false positives.

To prevent that, add an annotation that marks the method as always
safe for html. This is not ideal, but refactoring this method while
maintaining back-compat looks like it would be very challenging.

Bug: T197002
Change-Id: I9aded350ed4acc733b4fb697dd3400686a178fa9
includes/logging/LogFormatter.php