Not resolved instanceof property

[eapunk]

I am trying to write rules for such code

<?php
class SomeClass
{
    function method1()
    {
        $query = "update linked_docs set deleted=1 where id='" . $_POST['signed_id'] . "'";
        $this->db->query($query);
    }

    function method2()
    {
        global $focus;
        $focusId = $_REQUEST['record'];
        // $focusId = empty($focus->id) ? $_REQUEST['record'] : $focus->id;
        $where = "notes.parent_id='{$focusId}' AND notes.filename IS NOT NULL";
        $focus->get_full_list($where);
    }
}

I know classes of these objects but obviously analyzer fails to find class names.

Your example with 'ESAPI->validator' doesn't work for me.

I'd prefer to consider such code as vulnerabilities when function name is in sinks rules and class name is not resolved. Like this

diff --git a/package/src/progpilot/Inputs/MyInputs.php b/package/src/progpilot/Inputs/MyInputs.php
-                    if (!is_null($myclass) && $mysink->get_instanceof_name() === $myclass->get_name()) {
+                    if (empty($myclass) || $mysink->get_instanceof_name() === $myclass->get_name()) {
                         return $mysink;
-                                if ($myclass->get_name() === $mysink_instance_name) {
+                                if (empty($myclass) || $myclass->get_name() === $mysink_instance_name) {
                                     return $mysink;

[eric-therond]

I think your proposition is a good idea, but I am not sure about the possible impacts on false positives rate, maybe this could be configurated (if exactClassName (proposed name) is set to true so the behaviour is the same as today and if it's set to false the behaviour is like you proposed) and ideally this parameter must impact not only the sinks but also sources, validators and sanitizers).

For your initial problem I have fixed it and now you can use this sink :

{"name": "query", "instanceof": "SomeClass->db", "parameters": [{"id": 1, "condition": "QUOTES"}], "language": "php", "attack": "sql_injection", "cwe": "CWE_89"},