hullproof 0.0.0-stage → 0.5.0

package/rules/semgrep/taint-php.yaml

@@ -0,0 +1,361 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Written for the Hullproof Engine from the CWE definitions named in each rule. Not copied or derived from any Semgrep
+# registry rule. Fixtures: test/fixtures/rules/taint-php.php, run by test/rules.test.ts with semgrep --test.
+#
+# Sources are request data in plain PHP (the request superglobals and php://input) and Laravel or Symfony request
+# objects read through a variable named $request. Taint flows through string building, assignment and calls by
+# default. A project guard is recognised when its name says what it checks.
+rules:
+  - id: hullproof-taint-php-sql-injection
+    languages: [php]
+    mode: taint
+    severity: ERROR
+    message: >-
+      Request data reaches the text of a SQL query (CWE-89). Use a prepared statement with placeholders (PDO prepare
+      and execute, mysqli bind_param) or the query builder, and keep the query text constant.
+    metadata:
+      cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command"
+      sec_ids: [SEC-API-017]
+    pattern-sources:
+      - pattern-either:
+          - pattern: $_GET
+          - pattern: $_POST
+          - pattern: $_REQUEST
+          - pattern: $_COOKIE
+          - pattern: $_FILES
+          - pattern: $_SERVER
+          - pattern: file_get_contents("php://input")
+          - pattern: getallheaders()
+          - pattern: request(...)
+      - patterns:
+          - pattern-either:
+              - pattern: $request->$M(...)
+              - pattern: Request::$M(...)
+              - pattern: Input::$M(...)
+          - metavariable-regex:
+              metavariable: $M
+              regex: ^(input|get|query|post|all|only|except|header|cookie|file|json|getContent|route|string|str|integer|validated|safe)$
+      - patterns:
+          - pattern: $request->$F
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(query|request|headers|cookies|files|attributes)$
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: intval(...)
+          - pattern: floatval(...)
+          - pattern: (int) $X
+          - pattern: (float) $X
+          - pattern: (bool) $X
+
+      - pattern-either:
+          - pattern: mysqli_real_escape_string(...)
+          - pattern: $DB->real_escape_string(...)
+          - pattern: $DB->quote(...)
+          - pattern: pg_escape_string(...)
+          - pattern: pg_escape_literal(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: mysqli_query($C, $Q, ...)
+              - pattern: mysqli_multi_query($C, $Q)
+              - pattern: mysqli_prepare($C, $Q)
+              - pattern: mysql_query($Q, ...)
+              - pattern: pg_query($C, $Q)
+              - pattern: pg_query($Q)
+              - pattern: pg_prepare($C, $N, $Q)
+              - pattern: sqlite_query($C, $Q, ...)
+              - pattern: $DB->query($Q, ...)
+              - pattern: $DB->exec($Q)
+              - pattern: $DB->prepare($Q, ...)
+              - pattern: $DB->multi_query($Q)
+              - pattern: $DB->real_query($Q)
+              - pattern: DB::select($Q, ...)
+              - pattern: DB::statement($Q, ...)
+              - pattern: DB::unprepared($Q)
+              - pattern: DB::raw($Q)
+              - pattern: $QB->whereRaw($Q, ...)
+              - pattern: $QB->orWhereRaw($Q, ...)
+              - pattern: $QB->selectRaw($Q, ...)
+              - pattern: $QB->orderByRaw($Q, ...)
+              - pattern: $QB->havingRaw($Q, ...)
+          - focus-metavariable: $Q
+
+  - id: hullproof-taint-php-xss
+    languages: [php]
+    mode: taint
+    severity: ERROR
+    message: >-
+      Request data is written into the page without encoding (CWE-79). Encode it with htmlspecialchars($value,
+      ENT_QUOTES, 'UTF-8') where it is printed, or print it through a template engine that escapes by default (Blade
+      {{ }}, Twig).
+    metadata:
+      cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation"
+      sec_ids: [SEC-WEB-031]
+    pattern-sources:
+      - pattern-either:
+          - pattern: $_GET
+          - pattern: $_POST
+          - pattern: $_REQUEST
+          - pattern: $_COOKIE
+          - pattern: $_FILES
+          - pattern: $_SERVER
+          - pattern: file_get_contents("php://input")
+          - pattern: getallheaders()
+          - pattern: request(...)
+      - patterns:
+          - pattern-either:
+              - pattern: $request->$M(...)
+              - pattern: Request::$M(...)
+              - pattern: Input::$M(...)
+          - metavariable-regex:
+              metavariable: $M
+              regex: ^(input|get|query|post|all|only|except|header|cookie|file|json|getContent|route|string|str|integer|validated|safe)$
+      - patterns:
+          - pattern: $request->$F
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(query|request|headers|cookies|files|attributes)$
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: intval(...)
+          - pattern: floatval(...)
+          - pattern: (int) $X
+          - pattern: (float) $X
+          - pattern: (bool) $X
+
+      - pattern-either:
+          - pattern: htmlspecialchars(...)
+          - pattern: htmlentities(...)
+          - pattern: e(...)
+          - pattern: esc_html(...)
+          - pattern: esc_attr(...)
+          - pattern: json_encode(...)
+          - pattern: urlencode(...)
+          - pattern: rawurlencode(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: echo ..., $X, ...;
+              - pattern: print($X);
+              - pattern: printf(..., $X, ...);
+              - pattern: vprintf(..., $X, ...);
+              - pattern: print_r($X);
+              - pattern: exit($X);
+              - pattern: die($X);
+              - pattern: response($X, ...)
+          - focus-metavariable: $X
+
+  - id: hullproof-taint-php-command-injection
+    languages: [php]
+    mode: taint
+    severity: ERROR
+    message: >-
+      Request data reaches an operating system command (CWE-78). Avoid the shell: map the request value to a fixed set
+      of options, and if a value must reach a command, pass it through escapeshellarg.
+    metadata:
+      cwe: "CWE-78: Improper Neutralization of Special Elements used in an OS Command"
+      sec_ids: [SEC-API-020]
+    pattern-sources:
+      - pattern-either:
+          - pattern: $_GET
+          - pattern: $_POST
+          - pattern: $_REQUEST
+          - pattern: $_COOKIE
+          - pattern: $_FILES
+          - pattern: $_SERVER
+          - pattern: file_get_contents("php://input")
+          - pattern: getallheaders()
+          - pattern: request(...)
+      - patterns:
+          - pattern-either:
+              - pattern: $request->$M(...)
+              - pattern: Request::$M(...)
+              - pattern: Input::$M(...)
+          - metavariable-regex:
+              metavariable: $M
+              regex: ^(input|get|query|post|all|only|except|header|cookie|file|json|getContent|route|string|str|integer|validated|safe)$
+      - patterns:
+          - pattern: $request->$F
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(query|request|headers|cookies|files|attributes)$
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: intval(...)
+          - pattern: floatval(...)
+          - pattern: (int) $X
+          - pattern: (float) $X
+          - pattern: (bool) $X
+
+      - pattern: escapeshellarg(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: system($X, ...)
+              - pattern: exec($X, ...)
+              - pattern: shell_exec($X)
+              - pattern: passthru($X, ...)
+              - pattern: popen($X, ...)
+              - pattern: proc_open($X, ...)
+              - pattern: pcntl_exec($X, ...)
+              - pattern: new Symfony\Component\Process\Process($X, ...)
+              - pattern: Process::fromShellCommandline($X, ...)
+          - focus-metavariable: $X
+
+  - id: hullproof-taint-php-path-traversal
+    languages: [php]
+    mode: taint
+    severity: WARNING
+    message: >-
+      Request data becomes part of a file path the server includes, opens, writes or deletes (CWE-22, and CWE-98 for
+      include). Reduce the name with basename, or resolve it with realpath and check that it starts with a fixed root
+      folder before using it.
+    metadata:
+      cwe: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory"
+      sec_ids: []
+    pattern-sources:
+      - pattern-either:
+          - pattern: $_GET
+          - pattern: $_POST
+          - pattern: $_REQUEST
+          - pattern: $_COOKIE
+          - pattern: $_FILES
+          - pattern: $_SERVER
+          - pattern: file_get_contents("php://input")
+          - pattern: getallheaders()
+          - pattern: request(...)
+      - patterns:
+          - pattern-either:
+              - pattern: $request->$M(...)
+              - pattern: Request::$M(...)
+              - pattern: Input::$M(...)
+          - metavariable-regex:
+              metavariable: $M
+              regex: ^(input|get|query|post|all|only|except|header|cookie|file|json|getContent|route|string|str|integer|validated|safe)$
+      - patterns:
+          - pattern: $request->$F
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(query|request|headers|cookies|files|attributes)$
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: intval(...)
+          - pattern: floatval(...)
+          - pattern: (int) $X
+          - pattern: (float) $X
+          - pattern: (bool) $X
+
+      - pattern: basename(...)
+
+      - by-side-effect: true
+        patterns:
+          - pattern: $GUARD($X, ...)
+          - metavariable-regex:
+              metavariable: $GUARD
+              regex: (?i)^\w*(safe|allow|valid|guard|check|verify|within|inside|contain)\w*$
+          - focus-metavariable: $X
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: include $X;
+              - pattern: include_once $X;
+              - pattern: require $X;
+              - pattern: require_once $X;
+              - pattern: fopen($X, ...)
+              - pattern: file_get_contents($X, ...)
+              - pattern: file_put_contents($X, ...)
+              - pattern: file($X, ...)
+              - pattern: readfile($X, ...)
+              - pattern: unlink($X, ...)
+              - pattern: copy($X, ...)
+              - pattern: copy($S, $X, ...)
+              - pattern: rename($X, ...)
+              - pattern: rename($S, $X, ...)
+              - pattern: mkdir($X, ...)
+              - pattern: rmdir($X, ...)
+              - pattern: opendir($X, ...)
+              - pattern: scandir($X, ...)
+              - pattern: move_uploaded_file($S, $X)
+          - focus-metavariable: $X
+
+  - id: hullproof-taint-php-ssrf
+    languages: [php]
+    mode: taint
+    severity: ERROR
+    message: >-
+      Request data chooses the address of an outbound request the server makes (CWE-918). Allow only http and https,
+      resolve the host, refuse private, loopback, link local and metadata addresses, connect to the checked address
+      and check every redirect. A value that only fills a path or query under a fixed host is not matched.
+    metadata:
+      cwe: "CWE-918: Server-Side Request Forgery (SSRF)"
+      sec_ids: [SEC-API-035]
+    pattern-sources:
+      - pattern-either:
+          - pattern: $_GET
+          - pattern: $_POST
+          - pattern: $_REQUEST
+          - pattern: $_COOKIE
+          - pattern: $_FILES
+          - pattern: $_SERVER
+          - pattern: file_get_contents("php://input")
+          - pattern: getallheaders()
+          - pattern: request(...)
+      - patterns:
+          - pattern-either:
+              - pattern: $request->$M(...)
+              - pattern: Request::$M(...)
+              - pattern: Input::$M(...)
+          - metavariable-regex:
+              metavariable: $M
+              regex: ^(input|get|query|post|all|only|except|header|cookie|file|json|getContent|route|string|str|integer|validated|safe)$
+      - patterns:
+          - pattern: $request->$F
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(query|request|headers|cookies|files|attributes)$
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: intval(...)
+          - pattern: floatval(...)
+          - pattern: (int) $X
+          - pattern: (float) $X
+          - pattern: (bool) $X
+
+      - pattern-either:
+          - pattern: urlencode(...)
+          - pattern: rawurlencode(...)
+      - patterns:
+          - pattern: '"$URL" . $Y'
+          - metavariable-regex:
+              metavariable: $URL
+              regex: ^https?://[^/]+/
+
+      - by-side-effect: true
+        patterns:
+          - pattern: $GUARD($X, ...)
+          - metavariable-regex:
+              metavariable: $GUARD
+              regex: (?i)^\w*(safe|allow|valid|guard|check|verify)\w*$
+          - focus-metavariable: $X
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: curl_init($X)
+              - pattern: curl_setopt($C, CURLOPT_URL, $X)
+              - pattern: $HTTP->request($M, $X, ...)
+              - pattern: Http::get($X, ...)
+              - pattern: Http::post($X, ...)
+              - pattern: Http::put($X, ...)
+              - pattern: Http::delete($X, ...)
+              - pattern: Http::send($M, $X, ...)
+              - patterns:
+                  - pattern: $HTTP->$VERB($X, ...)
+                  - metavariable-regex:
+                      metavariable: $VERB
+                      regex: ^(get|post|put|patch|delete|head|getAsync|postAsync)$
+                  - metavariable-regex:
+                      metavariable: $HTTP
+                      regex: (?i).*(client|http|guzzle).*
+          - focus-metavariable: $X