Weave Code
Plugin Laravel Laravel Package
psalm/plugin-laravel
Laravel Psalm plugin for deep static analysis plus taint-based security scanning. Detects SQL injection, XSS, SSRF, shell injection, path traversal, and open redirects by tracking user input through Laravel code without running it.
Laravel static analysis with built-in security scanning
Frequently asked questions about Plugin Laravel
- How does psalm/plugin-laravel detect SQL injection vulnerabilities in Laravel apps?
- The plugin uses taint analysis to track user input (e.g., from `Request` objects) through your codebase. If unvalidated input reaches SQL sinks like `QueryBuilder` or Eloquent methods, Psalm flags it as a potential SQL injection risk. This works across controllers, services, and even stored data (e.g., user settings).
- Does this plugin work with Laravel 13 and Psalm 7.x?
- Yes, the plugin supports Laravel 11–13 and Psalm 6.x/7.x. Psalm 7.x enhances type refinements (e.g., for `Route::domain()`), but the plugin remains fully backward-compatible. Upgrade Psalm 7.x for improved conditional type handling if needed.
- Will this break my existing Psalm configuration?
- No, the plugin is non-breaking. It integrates seamlessly with existing Psalm setups—just run `./vendor/bin/psalm-laravel analyze`. CLI flags (e.g., `--ignore-missing-generics`) now propagate correctly, so no config changes are required unless you want to customize behavior.
- Can it detect XSS vulnerabilities in Blade templates?
- Yes, the plugin tracks tainted data through Blade directives (e.g., `@{{ $userInput }}`). If unvalidated input is echoed or used in HTML attributes, Psalm flags it as a potential XSS risk. Works alongside Laravel’s built-in Blade escaping rules for comprehensive coverage.
- How do I install psalm/plugin-laravel in a Laravel project?
- Run `composer require --dev psalm/plugin-laravel` and initialize it with `./vendor/bin/psalm-laravel init`. This generates Laravel-specific stubs and config files. No manual setup is needed for basic usage—just run `./vendor/bin/psalm-laravel analyze` to start scanning.
- Does it work in CI environments where Laravel isn’t fully bootstrapped?
- Yes, the plugin handles partial bootstraps (e.g., during `php artisan migrate` or schema analysis) without crashing. Fixes in v3.14+ ensure resilience in CI jobs where services like the migrator or container bindings aren’t fully initialized.
- What’s the performance impact of running this plugin?
- The plugin adds minimal overhead. Conditional type refinements (e.g., for `Arr::random()`) may slightly increase analysis time for complex facades, but the impact is negligible for most projects. Use `--threads=4` to parallelize analysis for large codebases.
- How do I suppress false positives, like the Route::domain() narrowing issue?
- Add a suppression comment above the line: `// @psalm-suppress InvalidArgument`. For example, if `Route::domain()` triggers false positives, suppress it locally. Test with `--diff` to verify no regressions after suppression.
- Is this plugin better than Larastan for Laravel static analysis?
- Psalm/plugin-laravel complements Larastan by adding **taint-based security scanning**, which Larastan cannot provide. Use both: Larastan for general type checking and this plugin for vulnerability detection (SQLi, XSS, etc.). They don’t overlap in functionality.
- How do I upgrade from an older version of the plugin?
- Update via Composer: `composer require psalm/plugin-laravel:^3.14.5`. Re-run `./vendor/bin/psalm-laravel init` to regenerate configs. Test thoroughly with `--diff` to catch any false positives or regressions. No manual migration steps are required.
Weaver
How can I help you explore Laravel packages today?