Add Psalm taint annotations for SQL injection analysis

src/PerformSql.php

@@ -10,6 +10,7 @@
 
 final class PerformSql implements PerformSqlInterface
 {
+    /** @psalm-taint-escape sql */
     #[Override]
     public function perform(ExtendedPdoInterface $pdo, string $sqlId, string $sql, array $values): PDOStatement
     {

src/PerformSqlInterface.php

@@ -18,6 +18,8 @@ interface PerformSqlInterface
      * @param array<string, mixed> $values The values to bind to the SQL statement.
      *
      * @return PDOStatement The result of the performed SQL statement.
+     *
+     * @psalm-taint-escape sql
      */
     public function perform(ExtendedPdoInterface $pdo, string $sqlId, string $sql, array $values): PDOStatement;
 }

src/PerformTemplatedSql.php

@@ -19,6 +19,7 @@ public function __construct(
     ) {
     }
 
+    /** @psalm-taint-escape sql */
     #[Override]
     public function perform(ExtendedPdoInterface $pdo, string $sqlId, string $sql, array $values): PDOStatement
     {

src/SqlQuery.php

@@ -54,6 +54,8 @@ public function __construct(
 
     /**
      * {@inheritDoc}
+     *
+     * @psalm-taint-escape sql
      */
     #[Override]
     public function exec(string $sqlId, array $values = [], FetchInterface|null $fetch = null): void
@@ -63,6 +65,8 @@ public function exec(string $sqlId, array $values = [], FetchInterface|null $fet
 
     /**
      * {@inheritDoc}
+     *
+     * @psalm-taint-escape sql
      */
     #[Override]
     public function getRow(string $sqlId, array $values = [], FetchInterface|null $fetch = null): array|object|null
@@ -80,6 +84,8 @@ public function getRow(string $sqlId, array $values = [], FetchInterface|null $f
 
     /**
      * {@inheritDoc}
+     *
+     * @psalm-taint-escape sql
      */
     #[Override]
     public function getRowList(string $sqlId, array $values = [], FetchInterface|null $fetch = null): array
@@ -92,6 +98,8 @@ public function getRowList(string $sqlId, array $values = [], FetchInterface|nul
 
     /**
      * {@inheritDoc}
+     *
+     * @psalm-taint-escape sql
      */
     #[Override]
     public function getCount(string $sqlId, array $values): int
@@ -193,6 +201,8 @@ public function getStatement(): PDOStatement
 
     /**
      * {@inheritDoc}
+     *
+     * @psalm-taint-escape sql
      */
     #[Override]
     public function getPages(string $sqlId, array $values, int $perPage, string $queryTemplate = '/{?page}', string|null $entity = null): PagesInterface

src/SqlQueryInterface.php

@@ -10,25 +10,39 @@ interface SqlQueryInterface
      * @param array<string, mixed> $values
      *
      * @return array<mixed>|object|null
+     *
+     * @psalm-taint-escape sql
      */
     public function getRow(string $sqlId, array $values = [], FetchInterface|null $fetch = null): array|object|null;
 
     /**
      * @param array<string, mixed> $values
      *
      * @return array<array<mixed>>
+     *
+     * @psalm-taint-escape sql
      */
     public function getRowList(string $sqlId, array $values = [], FetchInterface|null $fetch = null): array;
 
-    /** @param array<string, mixed> $values */
+    /**
+     * @param array<string, mixed> $values
+     *
+     * @psalm-taint-escape sql
+     */
     public function exec(string $sqlId, array $values = [], FetchInterface|null $fetch = null): void;
 
-    /** @param array<string, mixed> $values */
+    /**
+     * @param array<string, mixed> $values
+     *
+     * @psalm-taint-escape sql
+     */
     public function getCount(string $sqlId, array $values): int;
 
     /**
      * @param array<string, mixed> $values
      * @param ?class-string        $entity
+     *
+     * @psalm-taint-escape sql
      */
     public function getPages(string $sqlId, array $values, int $perPage, string $queryTemplate = '/{?page}', string|null $entity = null): PagesInterface;
 }

tests/sql/create_promise.sql

@@ -1,5 +1,6 @@
-CREATE TABLE IF NOT EXISTS todo
+CREATE TABLE IF NOT EXISTS promise
 (
-    id    INTEGER,
-    title TEXT
+    id    TEXT,
+    title TEXT,
+    time  TEXT
 )

tests/sql/create_todo.sql

@@ -1,6 +1,5 @@
-CREATE TABLE IF NOT EXISTS promise
+CREATE TABLE IF NOT EXISTS todo
 (
     id    TEXT,
-    title TEXT,
-    time  TEXT
+    title TEXT
 )