λgitsite

PHP: assume_safe_numbers also treats numeric casts as safe

ober

ef6f204447f3a012dbcac6745f66e476306d0ecb

diff --git a/lib/semgrep/scan.sls b/lib/semgrep/scan.sls
index 8aa18e9..c662fbe 100644
--- a/lib/semgrep/scan.sls
+++ b/lib/semgrep/scan.sls
@@ -32006,6 +32006,12 @@
   (def (text-contains-numeric-arithmetic? text)
        (and (text-contains-number? text)
             (text-contains-arithmetic-op? text)))
+  (def (text-contains-numeric-cast? text)
+       (or (string-find-substring text "(int)")
+           (string-find-substring text "(integer)")
+           (string-find-substring text "(float)")
+           (string-find-substring text "(double)")
+           (string-find-substring text "(real)")))
   (def (finding-starts-inside-square-brackets?
          outer
          inner
@@ -33133,7 +33139,8 @@
                        (text-contains-comparison? from-text))
                   (and (taint-assume-safe-numbers? rule)
                        from-text
-                       (text-contains-numeric-arithmetic? from-text))
+                       (or (text-contains-numeric-arithmetic? from-text)
+                           (text-contains-numeric-cast? from-text)))
                   (taint-safe-function-use?
                     rule
                     source-state
diff --git a/src/.jerbuild-hashes b/src/.jerbuild-hashes
index e28d356..86b3a0d 100644
--- a/src/.jerbuild-hashes
+++ b/src/.jerbuild-hashes
@@ -3,11 +3,11 @@
   ("src/semgrep/output/json.ss" . "293881CFA2ADB7BC")
   ("src/semgrep/lang.ss" . "6982E07679D20836")
   ("src/semgrep/parse/parse-target.ss" . "984D9B3DED8F3EFE")
-  ("src/semgrep/scan.ss" . "5A2E9AFF3229A61E")
+  ("src/semgrep/scan.ss" . "A9DB8F06E64C818F")
+  ("src/semgrep/schema/lang.ss" . "CAE2CA859C9A9FD0")
+  ("src/semgrep/rule.ss" . "E12C108153C181FA")
   ("src/semgrep/fix.ss" . "2E5B65B1FEF3B2B1")
   ("src/semgrep/output/text.ss" . "BE476CB84B807FBA")
-  ("src/semgrep/rule.ss" . "E12C108153C181FA")
-  ("src/semgrep/schema/lang.ss" . "CAE2CA859C9A9FD0")
   ("src/semgrep/match/structural.ss" . "8144F1297C91CF9F")
   ("src/semgrep/main.ss" . "A4EC9E7F2A09D25E")
   ("src/semgrep/cli.ss" . "EBDC4B1DAD3F13CC"))
diff --git a/src/semgrep/scan.ss b/src/semgrep/scan.ss
index 769b5b7..3ee350c 100644
--- a/src/semgrep/scan.ss
+++ b/src/semgrep/scan.ss
@@ -31916,6 +31916,14 @@
   (and (text-contains-number? text)
        (text-contains-arithmetic-op? text)))
 
+;; A cast to a numeric type makes the value a number (assume_safe_numbers).
+(def (text-contains-numeric-cast? text)
+  (or (string-find-substring text "(int)")
+      (string-find-substring text "(integer)")
+      (string-find-substring text "(float)")
+      (string-find-substring text "(double)")
+      (string-find-substring text "(real)")))
+
 (def (finding-starts-inside-square-brackets? outer inner source)
   (let ([outer-start (finding-start-offset outer)]
         [outer-end (finding-end-offset outer)]
@@ -33003,7 +33011,8 @@
                   (text-contains-comparison? from-text))
              (and (taint-assume-safe-numbers? rule)
                   from-text
-                  (text-contains-numeric-arithmetic? from-text))
+                  (or (text-contains-numeric-arithmetic? from-text)
+                      (text-contains-numeric-cast? from-text)))
              (taint-safe-function-use?
                rule
                source-state