kodingo-cli 1.1.3 → 1.1.5

package/dist/commands/security-scan.js

@@ -19,7 +19,7 @@ const security_code_analyzer_1 = require("../utils/security-code-analyzer");
 const context_assembler_1 = require("../utils/context-assembler");
 const ast_parser_1 = require("../utils/ast-parser");
 const IGNORED_DIRS = new Set(["node_modules", ".git", ".kortex", "dist", "build", "vendor", "out", ".next"]);
-const SUPPORTED_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".rs", ".php", ".java", ".kt", ".rb", ".c", ".cpp"];
+const SUPPORTED_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".rs", ".php", ".java", ".kt", ".rb", ".c", ".cpp", ".html", ".phtml", ".twig", ".blade.php"];
 function walkFiles(dir) {
     const results = [];
     try {

package/dist/utils/code-pattern-scanner.js

@@ -196,6 +196,63 @@ const RULES = [
         regex: /res\.cookie\s*\([^)]+\)(?!.*httpOnly)(?!.*secure)/,
         description: "Cookie set without httpOnly or Secure flags — session cookie may be accessible to JavaScript or transmitted over HTTP.",
     },
+    // ── PHP-specific patterns ──────────────────────────────────────────────────
+    {
+        type: "sql_injection",
+        severity: "critical",
+        regex: /mysqli_query\s*\([^,]+,\s*["'][^"']*["']\s*\.\s*\$|\$pdo->query\s*\(\s*["'][^"']*["']\s*\.\s*\$/,
+        description: "PHP SQL query built with string concatenation — use prepared statements with bound parameters.",
+        languages: ["php"],
+    },
+    {
+        type: "sql_injection",
+        severity: "critical",
+        regex: /\$_(?:GET|POST|REQUEST|COOKIE)\[[^\]]+\][^;\n]*(?:query|execute|mysqli_query)/,
+        description: "Unsanitised PHP superglobal used directly in a database query — SQL injection vulnerability.",
+        languages: ["php"],
+    },
+    {
+        type: "command_injection",
+        severity: "critical",
+        regex: /(?:exec|shell_exec|system|passthru|popen)\s*\([^)]*\$_(?:GET|POST|REQUEST|COOKIE)/,
+        description: "PHP shell execution with unsanitised user input — command injection vulnerability.",
+        languages: ["php"],
+    },
+    {
+        type: "path_traversal",
+        severity: "high",
+        regex: /(?:include|require|include_once|require_once|file_get_contents|fopen|readfile)\s*\([^)]*\$_(?:GET|POST|REQUEST)/,
+        description: "PHP file inclusion with unsanitised user input — path traversal or local file inclusion vulnerability.",
+        languages: ["php"],
+    },
+    {
+        type: "hardcoded_secret",
+        severity: "high",
+        regex: /\$(?:password|passwd|secret|api_key|apikey|token|private_key)\s*=\s*['"][A-Za-z0-9_\-\/+=]{12,}['"]/i,
+        description: "PHP hardcoded credential — store secrets in environment variables, not source code.",
+        languages: ["php"],
+    },
+    {
+        type: "ssrf",
+        severity: "high",
+        regex: /(?:curl_init|file_get_contents|fopen)\s*\([^)]*\$_(?:GET|POST|REQUEST)/,
+        description: "PHP HTTP request using unsanitised user input as URL — SSRF vulnerability.",
+        languages: ["php"],
+    },
+    {
+        type: "insecure_crypto",
+        severity: "high",
+        regex: /md5\s*\(\s*\$(?:password|passwd|pass)|sha1\s*\(\s*\$(?:password|passwd|pass)/,
+        description: "PHP password hashed with MD5 or SHA1 — use password_hash() with PASSWORD_BCRYPT.",
+        languages: ["php"],
+    },
+    {
+        type: "open_redirect",
+        severity: "high",
+        regex: /header\s*\(\s*['"]Location:\s*['"]\s*\.\s*\$_(?:GET|POST|REQUEST)/,
+        description: "PHP Location header set from unsanitised user input — open redirect vulnerability.",
+        languages: ["php"],
+    },
 ];
 /**
  * Scans a single symbol's body against all pattern rules. Returns every match —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodingo-cli",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "description": "Kodingo CLI",
   "license": "MIT",
   "private": false,