Weave Code
Plugin Laravel Laravel Package
psalm/plugin-laravel
Laravel Psalm plugin for deep static analysis plus taint-based security scanning. Detect SQL injection, XSS, SSRF, shell injection, path traversal, and open redirects by tracking user input through Laravel code—without executing it. Complements Larastan/PHPStan.
Laravel static analysis with built-in security scanning
Frequently asked questions about Plugin Laravel
- How does psalm/plugin-laravel differ from Larastan or PHPStan for Laravel?
- This plugin adds **taint analysis** (security-focused) to Psalm’s static analysis, while Larastan/PHPStan focus on type correctness. It detects vulnerabilities like SQL injection or XSS by tracking user input through Laravel’s facades, Eloquent, and Request handling—something neither Larastan nor PHPStan can do natively.
- Can I use psalm/plugin-laravel in Laravel 10 or older versions?
- The plugin officially supports Laravel 11 (v3.x) and 12/13 (v4.x). Laravel 10 support is deprecated, and versions below 11 lack full feature compatibility. If you’re on an older version, consider upgrading or manually configuring stubs for missing features.
- Will this plugin slow down my CI pipeline significantly?
- Static analysis can be resource-intensive, but Psalm mitigates this with parallel execution (`--workers`), incremental mode, and CI caching (e.g., GitHub Actions). Start with `errorLevel 8` (security-only) to minimize noise, then gradually tighten rules. For large codebases, run it on PRs instead of every push.
- How do I handle false positives, like Psalm flagging a known-safe input source?
- Use `psalm-baseline.xml` to suppress false positives globally, or configure `errorLevel` (1–8) to adjust sensitivity. For specific cases, annotate tainted sources with `@psalm-suppress Tainted*` or use `Js::encode()` for trusted outputs. The plugin also supports per-call-site taint specialization.
- Does psalm/plugin-laravel work with Laravel’s dynamic features like macros or package-specific facades?
- Most core Laravel features are supported, but dynamic macros or custom facades may require manual stubs. Check the [plugin’s stubs directory](https://github.com/psalm/psalm-plugin-laravel/tree/master/stubs) for templates. If a feature is missing, contribute a stub or configure Psalm to ignore it temporarily.
- Can I integrate this with existing PHPStan or Larastan setups?
- Yes, but avoid running them simultaneously on the same codebase to prevent annotation conflicts. Use Psalm for security (taint analysis) and Larastan/PHPStan for type checks. Run Psalm first, then Larastan, to ensure compatibility with Psalm’s stricter type system.
- What’s the minimal setup to start using psalm/plugin-laravel?
- Install via Composer: `composer require --dev psalm/plugin-laravel`. Initialize the plugin with `./vendor/bin/psalm-laravel init`, then run `./vendor/bin/psalm --init` to generate a config. Start analysis with `./vendor/bin/psalm-laravel analyze --level 8` for security-focused checks.
- How does taint analysis work across multiple layers, like a service class passing user input to a controller?
- The plugin tracks data flow **across function boundaries**, including service classes, helpers, and even stored session data. If user input (e.g., `$request->input()`) is passed through a chain of methods and eventually used in a vulnerable sink (e.g., `DB::query()`), Psalm will flag it as tainted.
- Is Psalm 7.x (beta) required, or can I use a stable Psalm 6.x version?
- The plugin requires Psalm 6.x or 7.x (beta). If you’re using Psalm 6.x, pin to a stable release to avoid beta instability. For Psalm 7.x, monitor its release cycle or use `--strict-types` to catch early issues. The plugin’s GitHub Actions workflow tests against both versions.
- What if I need custom security rules, like HIPAA compliance checks?
- The plugin is extensible: Add custom stubs for domain-specific sinks/sources or override taint rules in `psalm.xml`. For example, you could mark a `Patient::setSsn()` method as a tainted sink or exclude certain input sources. Check the [plugin’s docs](https://github.com/psalm/psalm-plugin-laravel#customization) for advanced configuration.
Weaver
How can I help you explore Laravel packages today?