Psalm 7 turns on security analysis by default and makes it 10x faster
Psalm 7 release: PHP security&static analysis software
Psalm 7 ships with taint analysis enabled by default, now up to 10x faster and folded into the same run as type checking and dead code detection. It tracks NoSQL, LLM prompt and URL injection, follows taint through closures, generators and traits, and bundles stubs for Guzzle, PSR-7 and Monolog. A new capability-based purity model replaces the old annotations, dead code detection is graph-based, and PHP 8.5 and 8.6 are fully supported.
Taints are now stored as a bitmask, and the taint graph is resolved over compact summaries of each function. This makes security analysis up to 10x faster.
- idoubtit
For anyone not familiar with PHP, static analysis is pretty much required because the official PHP type system is minimal. The detailed types are added through phpdoc comments, and they also help IDEs to provide a sane completion. For instance, the plain "array" should be detailed with phpdoc:
/**
* @param array<string, MyRecord> $input
* @return list<int>
*/
function foo(array $input): array
{
foreach ($input as $string => $record) {
// IDE knows $record is an instance of MyRecord
The static analysis will use both type systems, and it's the only way to check that phpdoc are consistent. Psalm has various levels of strictness, and even at a very lax level, it can help detect errors or code smells.
There are two major static analysis tools for PHP, Psalm and PHPstan, both written in PHP. The latter used to be much slower, but last time I tried it there was little difference (about 20 s for 100k lines + dependencies).
My guess is that a new contender, Mago, written in Rust, will probably soon replace those other tools. Its commands (analyze, lint) are already almost as complete as psalm/phpstan. Though the migration won't be easy because it does not have a notion of levels.
- anthk
Thou shall use the Rust rewrite of PHP.
- origini
Ah boy o boy, PHP was the first lanuage I teached myself but man it still needs PHPDoc comment on return types?
Come on PHP has so many shitty things, but even something basic like this is still not in the lanuage itself?