psalm/plugin-laravel
Psalm plugin for Laravel that adds deep framework-aware static analysis plus taint-based security scanning. Detects SQL injection, XSS, SSRF, shell injection, file traversal, and open redirects by tracking user input flows across functions and services.
Emitted when view() or Factory::make() (e.g., view()->make()) references a Blade template that does not exist on disk.
Facade calls like View::make() are not currently detected (see #591).
If the referenced view file doesn't exist, Laravel throws an InvalidArgumentException at runtime.
This check catches typos and missing templates during static analysis.
// Bad — typo in the view name
view('emails.welcom'); // MissingView
// Good — the view file exists
view('emails.welcome');
// Bad — referencing a deleted template
view('admin.old-dashboard'); // MissingView
// Good
view('admin.dashboard');
resources/views/emails/welcome.blade.php)view('package::view.name')) — namespaced views are not checked by this ruleThis check is disabled by default. Enable it in your psalm.xml:
<plugins>
<pluginClass class="Psalm\LaravelPlugin\Plugin">
<findMissingViews value="true" />
</pluginClass>
</plugins>
mail::html.header) are skipped.blade.php and .php extensions are checkedconfig('view.paths') plus paths added by service providers)How can I help you explore Laravel packages today?