Set @return-taint of Sanitizer::stripAllTags to tainted

phan-taint-check (aka SecurityCheckPlugin) doesn't recognize
Sanitizer::stripAllTags' output as tainted in certain situations.
Adding a @return-taint of tainted to ensure that it does, which
may result in the reporting of more issues.

Bug: T230234
Change-Id: I357c168417a26882c7c460df20f36ec2be401096

diff --git a/includes/parser/Sanitizer.php b/includes/parser/Sanitizer.php
index 8e0cf5c..d411046 100644 (file)
--- a/includes/parser/Sanitizer.php
+++ b/includes/parser/Sanitizer.php
@@ -2036,6 +2036,7 @@ class Sanitizer {
         *
         * @param string $html HTML fragment
         * @return string
+        * @return-taint tainted
         */
        static function stripAllTags( $html ) {
                // Use RemexHtml to tokenize $html and extract the text