seaworthycode 1.1.2 → 1.1.4

package/rules/internal/taint/php.yaml

@@ -0,0 +1,331 @@
+# attribution: CWE-79
+attribution: CWE-79
+language: php
+applies-to: []
+
+sources:
+  - id: superglobal.GET
+    class: http-params
+    query: |
+      (subscript_expression
+        (variable_name
+          (name) @sg)
+        (#eq? @sg "_GET")) @source
+
+  - id: superglobal.POST
+    class: http-body
+    query: |
+      (subscript_expression
+        (variable_name
+          (name) @sg)
+        (#eq? @sg "_POST")) @source
+
+  - id: superglobal.REQUEST
+    class: http-params
+    query: |
+      (subscript_expression
+        (variable_name
+          (name) @sg)
+        (#eq? @sg "_REQUEST")) @source
+
+  - id: superglobal.COOKIE
+    class: http-params
+    query: |
+      (subscript_expression
+        (variable_name
+          (name) @sg)
+        (#eq? @sg "_COOKIE")) @source
+
+  - id: superglobal.FILES
+    class: http-body
+    query: |
+      (subscript_expression
+        (variable_name
+          (name) @sg)
+        (#eq? @sg "_FILES")) @source
+
+  - id: php-input
+    class: http-body
+    query: |
+      (function_call_expression
+        function: (name) @func
+        (#eq? @func "file_get_contents")
+        arguments: (arguments
+          (argument
+            (encapsed_string
+              (string_content) @path
+              (#eq? @path "php://input"))))) @source
+
+  - id: argv
+    class: process-argv
+    query: |
+      (subscript_expression
+        (variable_name
+          (name) @sg)
+        (#eq? @sg "argv")) @source
+
+  - id: input
+    class: process-argv
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "input")) @source
+
+  - id: superglobal.ENV
+    class: env-var
+    query: |
+      (subscript_expression
+        (variable_name
+          (name) @sg)
+        (#eq? @sg "_ENV")) @source
+
+  - id: getenv
+    class: env-var
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "getenv")) @source
+
+  - id: file_get_contents-read
+    class: fs-read
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "file_get_contents")
+        arguments: (arguments
+          (_) @path)) @source
+
+  - id: curl_exec
+    class: network-response
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "curl_exec")) @source
+
+sinks:
+  - id: eval
+    sink-class: code-execution
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "eval")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: echo
+    sink-class: xss
+    query: |
+      (echo_statement (_) @sink) @match
+
+  - id: print
+    sink-class: xss
+    query: |
+      (print_intrinsic (_) @sink) @match
+
+  - id: printf
+    sink-class: xss
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "printf")
+        arguments: (arguments
+          (argument (_) @sink))) @match
+
+  - id: short-echo
+    sink-class: xss
+    query: |
+      (program
+        (php_tag) @tag
+        .
+        (expression_statement (_) @sink)
+        (#match? @tag "^<\\?=")) @match
+
+  - id: mysqli_query
+    sink-class: sql-injection
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "mysqli_query")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: mysqli_multi_query
+    sink-class: sql-injection
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "mysqli_multi_query")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: pdo.query
+    sink-class: sql-injection
+    query: |
+      (member_call_expression
+        name: (name) @method
+        (#match? @method "^(query|exec)$")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: mysql_query
+    sink-class: sql-injection
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "mysql_query")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: system
+    sink-class: command-injection
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "system")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: exec
+    sink-class: command-injection
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "exec")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: shell_exec
+    sink-class: command-injection
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "shell_exec")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: passthru
+    sink-class: command-injection
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "passthru")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: include
+    sink-class: path-traversal
+    query: |
+      (include_expression (_) @sink) @match
+
+  - id: require
+    sink-class: path-traversal
+    query: |
+      (require_expression (_) @sink) @match
+
+  - id: include_once
+    sink-class: path-traversal
+    query: |
+      (include_once_expression (_) @sink) @match
+
+  - id: require_once
+    sink-class: path-traversal
+    query: |
+      (require_once_expression (_) @sink) @match
+
+  - id: file_get_contents-path
+    sink-class: path-traversal
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "file_get_contents")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: fopen
+    sink-class: path-traversal
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "fopen")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: readfile
+    sink-class: path-traversal
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "readfile")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: header
+    sink-class: url-injection
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "header")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: array_merge-pollution
+    sink-class: prototype-pollution
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "array_merge")
+        arguments: (arguments (_) @first (_) @sink)) @match
+
+sanitisers:
+  - id: htmlspecialchars
+    sanitises: [xss]
+    autofix-safety: manual
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "htmlspecialchars")) @sanitiser
+
+  - id: htmlentities
+    sanitises: [xss]
+    autofix-safety: manual
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "htmlentities")) @sanitiser
+
+  - id: intval
+    sanitises: [sql-injection]
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "intval")) @sanitiser
+
+  - id: mysqli_real_escape_string
+    sanitises: [sql-injection]
+    autofix-safety: manual
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "mysqli_real_escape_string")) @sanitiser
+
+  - id: pdo.prepare
+    sanitises: [sql-injection]
+    query: |
+      (member_call_expression
+        name: (name) @method
+        (#eq? @method "prepare")) @sanitiser
+
+  - id: escapeshellarg
+    sanitises: [command-injection]
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "escapeshellarg")) @sanitiser
+
+  - id: basename
+    sanitises: [path-traversal]
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "basename")) @sanitiser
+
+  - id: filter_var-url
+    sanitises: [url-injection]
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "filter_var")) @sanitiser
+
+  - id: array_replace-pollution
+    sanitises: [prototype-pollution]
+    query: |
+      (function_call_expression
+        (name) @func
+        (#eq? @func "array_replace")) @sanitiser