phpwarden 2.2.1__tar.gz → 2.3.0__tar.gz

{phpwarden-2.2.1 → phpwarden-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phpwarden
-Version: 2.2.1
+Version: 2.3.0
 Summary: PHP vulnerability scanner for the PHP engine, Composer, WordPress, your own code and the live site. Ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero dependencies.
 Author: oroma-alfred
 License-Expression: Apache-2.0
@@ -59,7 +59,8 @@ $ phpwarden deps composer.lock
 | Composer dependency CVEs | `deps` | Snyk, `composer audit` |
 | WordPress core, plugin and theme CVEs | `wordpress` | Patchstack, Wordfence |
 | WordPress file integrity (wordpress.org checksums, injected files) | `integrity` | Wordfence CLI malware-scan (partly) |
-| Your own PHP code (75 rules) | `code` | — (not a PHPStan/Psalm replacement) |
+| Your own PHP code: whole-program, Laravel/Symfony/WordPress-aware (89 rules) | `code` | Snyk Code, Semgrep, Psalm taint |
+| Exploits of the vulnerabilities this site has, blocked inside PHP | `shield` | the WAF rule you would have to write |
 | Live site from outside: exposed files, debug endpoints | `probe` | — |
 | One ranked verdict across all of the above | `assess` | — |
 | Exploitation signatures in logs | `detect` | SIEM content |
@@ -120,7 +121,8 @@ phpwarden rules --format nginx --out php-block.conf   # PHP-specific WAF rules (
 phpwarden rules --format nginx --dry-run     # the same rules, log-only: nothing is blocked
 phpwarden rules --replay /var/log/nginx/access.log    # what the rules would have blocked in an existing log
 phpwarden probe https://example.com  # live check of a site you own: exposed files, debug endpoints, versions vs the feed
-phpwarden code .                     # your own PHP: 75 high-signal rules, 74 on by default (injection, unserialize, WordPress handlers)
+phpwarden code .                     # your own PHP, whole program: 89 rules (injection, auth, mass assignment, Blade/Twig, WordPress)
+phpwarden shield policy . && phpwarden shield install   # block exploits of what is installed here, inside PHP (log-only first)
 phpwarden assess . --url https://example.com --log access.log   # one ranked verdict; --out / --baseline shows what is fixed and verified
 phpwarden report web01.json web02.json --out fleet.html   # aggregate a fleet view
 phpwarden feed status                # which feed is active, how many advisories
@@ -133,7 +135,7 @@ phpwarden feed update                # pull a newer feed: free weekly snapshot,
 `probe`, `code`, `assess`, `--format sarif`, `rules --dry-run` / `--replay` and
 the no-key `feed update` are new in 2.2.0.
 
-Every command takes `--json`. Exit codes are shared across subcommands and
+Every scanning command takes `--json` (`shield install` and `shield promote` do not). Exit codes are shared across subcommands and
 built for gating: `0` clean, `1` exposed / vulnerable / signature hits / tampered
 files / high or critical `code` and `probe` findings (`probe` also on any
 known-exploited finding) / anything to act on now or this week (`assess`),
@@ -142,7 +144,7 @@ error, `5` `--report-to` upload failed on an otherwise clean run, `64` usage
 error. Full table: `phpwarden --help`.
 
 
-## New in 2.2.0
+## New in 2.3.0 and 2.2
 
 - **`phpwarden probe URL`**: a live check of a running site using GET and HEAD
   requests only. It looks for exposed files (`.env`, `.git`, backups), open debug
@@ -150,11 +152,21 @@ error. Full table: `phpwarden --help`.
   matches those against the feed. Active checks run only after you prove the
   site is yours (DNS TXT record, a file, or a meta tag; `--print-token` shows
   how). Without that it reads the homepage and stops.
-- **`phpwarden code PATH`**: 75 rules (74 on by default) for your own PHP code, following request
-  data to `eval`, shell commands, SQL, `unserialize`, includes and redirects.
-  It follows data across files (helper functions and classes elsewhere in the
-  project, fixed includes, class properties); it is not a type checker like
-  PHPStan or Psalm. `phpwarden code --list-rules` lists every rule.
+- **`phpwarden code PATH`** (whole-program engine, default in 2.3.0): parses the
+  project, resolves namespaces, Composer autoloading, inheritance and types, and
+  follows request data across files to SQL, shell, `eval`, `unserialize`,
+  includes, redirects and HTTP clients, with a trace per finding (SARIF
+  `codeFlows`). Models Laravel, Symfony and WordPress: routes with no auth check,
+  mass assignment, raw Blade/Twig output, IDOR hints, CSRF exclusions, nonces.
+  Follows data stored in the session or WordPress options (second-order).
+  89 rules. On the same pinned apps it found more than Semgrep and Psalm with far
+  fewer findings on clean framework code ([comparison](https://github.com/oroma-alfred/phpwarden/tree/main/bench/sast-compare-2026-11)).
+  Data that round-trips through the database is not followed.
+- **`phpwarden shield`**: one PHP file loaded before your app that blocks exploit
+  attempts against the exploited vulnerabilities this site actually has, scoped
+  to their entry points. Logs until you promote rules (7-day burn-in, explicit
+  flag), fails open, has a kill switch, about 0.07 ms per request. Not an edge
+  WAF: no DDoS, bot or TLS handling.
 - **`phpwarden assess`**: one ranked list from every view of a site: installed
   versions, your code, the live site from outside, and the access log, with the
   reason for each item ("exploited, reachable, visible from outside, already
@@ -236,7 +248,7 @@ see [phpwarden/laravel](https://packagist.org/packages/phpwarden/laravel).
 ```yaml
 repos:
   - repo: https://github.com/oroma-alfred/phpwarden
-    rev: v2.1.0        # pin to a tag with `pre-commit autoupdate`
+    rev: v2.3.0        # pin to a tag with `pre-commit autoupdate`
     hooks:
       - id: phpwarden-deps
         # args: ["--no-reachability"]   # faster: skip the reachability pass

{phpwarden-2.2.1 → phpwarden-2.3.0}/README.md

@@ -37,7 +37,8 @@ $ phpwarden deps composer.lock
 | Composer dependency CVEs | `deps` | Snyk, `composer audit` |
 | WordPress core, plugin and theme CVEs | `wordpress` | Patchstack, Wordfence |
 | WordPress file integrity (wordpress.org checksums, injected files) | `integrity` | Wordfence CLI malware-scan (partly) |
-| Your own PHP code (75 rules) | `code` | — (not a PHPStan/Psalm replacement) |
+| Your own PHP code: whole-program, Laravel/Symfony/WordPress-aware (89 rules) | `code` | Snyk Code, Semgrep, Psalm taint |
+| Exploits of the vulnerabilities this site has, blocked inside PHP | `shield` | the WAF rule you would have to write |
 | Live site from outside: exposed files, debug endpoints | `probe` | — |
 | One ranked verdict across all of the above | `assess` | — |
 | Exploitation signatures in logs | `detect` | SIEM content |
@@ -98,7 +99,8 @@ phpwarden rules --format nginx --out php-block.conf   # PHP-specific WAF rules (
 phpwarden rules --format nginx --dry-run     # the same rules, log-only: nothing is blocked
 phpwarden rules --replay /var/log/nginx/access.log    # what the rules would have blocked in an existing log
 phpwarden probe https://example.com  # live check of a site you own: exposed files, debug endpoints, versions vs the feed
-phpwarden code .                     # your own PHP: 75 high-signal rules, 74 on by default (injection, unserialize, WordPress handlers)
+phpwarden code .                     # your own PHP, whole program: 89 rules (injection, auth, mass assignment, Blade/Twig, WordPress)
+phpwarden shield policy . && phpwarden shield install   # block exploits of what is installed here, inside PHP (log-only first)
 phpwarden assess . --url https://example.com --log access.log   # one ranked verdict; --out / --baseline shows what is fixed and verified
 phpwarden report web01.json web02.json --out fleet.html   # aggregate a fleet view
 phpwarden feed status                # which feed is active, how many advisories
@@ -111,7 +113,7 @@ phpwarden feed update                # pull a newer feed: free weekly snapshot,
 `probe`, `code`, `assess`, `--format sarif`, `rules --dry-run` / `--replay` and
 the no-key `feed update` are new in 2.2.0.
 
-Every command takes `--json`. Exit codes are shared across subcommands and
+Every scanning command takes `--json` (`shield install` and `shield promote` do not). Exit codes are shared across subcommands and
 built for gating: `0` clean, `1` exposed / vulnerable / signature hits / tampered
 files / high or critical `code` and `probe` findings (`probe` also on any
 known-exploited finding) / anything to act on now or this week (`assess`),
@@ -120,7 +122,7 @@ error, `5` `--report-to` upload failed on an otherwise clean run, `64` usage
 error. Full table: `phpwarden --help`.
 
 
-## New in 2.2.0
+## New in 2.3.0 and 2.2
 
 - **`phpwarden probe URL`**: a live check of a running site using GET and HEAD
   requests only. It looks for exposed files (`.env`, `.git`, backups), open debug
@@ -128,11 +130,21 @@ error. Full table: `phpwarden --help`.
   matches those against the feed. Active checks run only after you prove the
   site is yours (DNS TXT record, a file, or a meta tag; `--print-token` shows
   how). Without that it reads the homepage and stops.
-- **`phpwarden code PATH`**: 75 rules (74 on by default) for your own PHP code, following request
-  data to `eval`, shell commands, SQL, `unserialize`, includes and redirects.
-  It follows data across files (helper functions and classes elsewhere in the
-  project, fixed includes, class properties); it is not a type checker like
-  PHPStan or Psalm. `phpwarden code --list-rules` lists every rule.
+- **`phpwarden code PATH`** (whole-program engine, default in 2.3.0): parses the
+  project, resolves namespaces, Composer autoloading, inheritance and types, and
+  follows request data across files to SQL, shell, `eval`, `unserialize`,
+  includes, redirects and HTTP clients, with a trace per finding (SARIF
+  `codeFlows`). Models Laravel, Symfony and WordPress: routes with no auth check,
+  mass assignment, raw Blade/Twig output, IDOR hints, CSRF exclusions, nonces.
+  Follows data stored in the session or WordPress options (second-order).
+  89 rules. On the same pinned apps it found more than Semgrep and Psalm with far
+  fewer findings on clean framework code ([comparison](https://github.com/oroma-alfred/phpwarden/tree/main/bench/sast-compare-2026-11)).
+  Data that round-trips through the database is not followed.
+- **`phpwarden shield`**: one PHP file loaded before your app that blocks exploit
+  attempts against the exploited vulnerabilities this site actually has, scoped
+  to their entry points. Logs until you promote rules (7-day burn-in, explicit
+  flag), fails open, has a kill switch, about 0.07 ms per request. Not an edge
+  WAF: no DDoS, bot or TLS handling.
 - **`phpwarden assess`**: one ranked list from every view of a site: installed
   versions, your code, the live site from outside, and the access log, with the
   reason for each item ("exploited, reachable, visible from outside, already
@@ -214,7 +226,7 @@ see [phpwarden/laravel](https://packagist.org/packages/phpwarden/laravel).
 ```yaml
 repos:
   - repo: https://github.com/oroma-alfred/phpwarden
-    rev: v2.1.0        # pin to a tag with `pre-commit autoupdate`
+    rev: v2.3.0        # pin to a tag with `pre-commit autoupdate`
     hooks:
       - id: phpwarden-deps
         # args: ["--no-reachability"]   # faster: skip the reachability pass

{phpwarden-2.2.1 → phpwarden-2.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phpwarden"
-version = "2.2.1"
+version = "2.3.0"
 description = "PHP vulnerability scanner for the PHP engine, Composer, WordPress, your own code and the live site. Ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero dependencies."
 readme = "README.md"
 requires-python = ">=3.8"
@@ -39,4 +39,4 @@ package-dir = { "" = "src" }
 where = ["src"]
 
 [tool.setuptools.package-data]
-phpwarden = ["data/*.json"]
+phpwarden = ["data/*.json", "shield/agent/*.php"]

{phpwarden-2.2.1 → phpwarden-2.3.0}/src/phpwarden/__init__.py

@@ -6,4 +6,4 @@ real-world exploitation (CISA KEV, then EPSS, then CVSS), and can watch PHP-FPM
 for active exploitation. The engine and the bundled feed are open; free users
 get weekly feed updates, and a subscription adds the feed rebuilt twice a day.
 """
-__version__ = "2.2.1"
+__version__ = "2.3.0"

{phpwarden-2.2.1 → phpwarden-2.3.0}/src/phpwarden/cli.py

@@ -13,6 +13,7 @@
   phpwarden probe URL            safe live HTTP check of a site you own
   phpwarden code PATH            scan your own PHP code for high-signal security bugs
   phpwarden assess PATH --url U --log L   one ranked verdict from every view
+  phpwarden shield policy PATH   protection inside PHP for the exploited vulns installed here
 
 Exit codes (shared by every subcommand; usable as a CI gate):
   0   nothing applies / clean
@@ -562,6 +563,85 @@ def _assess(args):
     return vd.exit_code(res)
 
 
+def _shield(args):
+    from pathlib import Path as _P
+    from phpwarden.shield import policy as sp, report as sr
+    if args.shield_cmd == "policy":
+        root = _P(args.path)
+        if not root.is_dir():
+            sys.stderr.write(f"error: not a directory: {args.path}\n")
+            return 4
+        pol = sp.build_policy_for_path(str(root), FeedManager().current(), php_version=args.php_version,
+                                       php_sapi=args.php_sapi, log_path=args.log)
+        out = args.out or "phpwarden-shield.policy.json"
+        j, php = sp.write_policy(pol, out)
+        if args.json:
+            print(json.dumps(pol, indent=2))
+            return 0
+        print(f"wrote {j} and {php}  ({len(pol['rules'])} rule(s), mode: log)")
+        for r in pol["rules"]:
+            print(f"  + {r['id']:<34} {r.get('cve') or '':<16} {r['component']}: {r['why']}")
+        if not pol["rules"]:
+            print("  No exploited vulnerability with a known request shape is installed here; the policy only has")
+            print("  the generic checks, if any applied. Nothing to protect against beyond those.")
+        print("\nNext: `phpwarden shield install` shows how to load the agent. It only logs until you promote rules.")
+        return 0
+    if args.shield_cmd == "install":
+        agent = _P(__file__).resolve().parent / "shield" / "agent" / "phpwarden-shield.php"
+        dest = _P(args.dest) if args.dest else None
+        if dest:
+            try:
+                dest.mkdir(parents=True, exist_ok=True)
+                (dest / "phpwarden-shield.php").write_bytes(agent.read_bytes())
+            except OSError as e:
+                sys.stderr.write(f"error: {e}\n")
+                return 4
+            where = (dest / "phpwarden-shield.php").resolve()
+            print(f"copied the agent to {where}")
+        else:
+            where = "/path/to/phpwarden-shield.php"
+            print(f"The agent ships with phpwarden at {agent}. Copy it next to your site, or rerun with --dest DIR.")
+        print(f"""
+Load it before your application (pick one; nothing is changed for you):
+  php.ini or .user.ini:   auto_prepend_file={where}
+  WordPress:              add  require '{where}';  as the first line of wp-config.php
+  Laravel / other apps:   add  require '{where}';  at the top of public/index.php
+
+Put phpwarden-shield.policy.php (from `phpwarden shield policy`) next to the agent, or set
+PHPWARDEN_SHIELD_POLICY to its path. It starts in log-only mode and fails open on any error.
+Turn it off instantly: create a file named phpwarden-shield.off next to the agent, or set
+PHPWARDEN_SHIELD=off.""")
+        return 0
+    if args.shield_cmd == "report":
+        try:
+            with open(args.log, errors="replace") as fh:
+                summ = sr.summarize(fh)
+        except OSError as e:
+            sys.stderr.write(f"error: {e}\n")
+            return 4
+        print(json.dumps(summ, indent=2, default=list) if args.json else sr.to_text(summ))
+        return 0
+    if args.shield_cmd == "promote":
+        try:
+            pol = json.loads(_P(args.policy).read_text())
+            with open(args.log, errors="replace") as fh:
+                summ = sr.summarize(fh)
+        except (OSError, ValueError) as e:
+            sys.stderr.write(f"error: {e}\n")
+            return 4
+        pol, rep = sp.promote(pol, summ, operator_ack=args.i_understand_this_blocks_requests,
+                              rule_ids=set(args.rule) if args.rule else None)
+        for rid in rep["promoted"]:
+            print(f"  BLOCK  {rid}")
+        for r in rep["refused"]:
+            print(f"  still logging  {r['id']}: {r['reason']}")
+        if rep["promoted"]:
+            sp.write_policy(pol, args.policy)
+            print(f"\nupdated {args.policy} (and its .php twin). Promoted rules now return 403.")
+        return 0
+    return EX_USAGE
+
+
 def _integrity(args):
     from phpwarden import integrity as integ
     res = integ.check(args.path, locale=args.locale, plugins=not args.no_plugins)
@@ -674,6 +754,29 @@ def main(argv=None):
     _report_args(wpc)
     wpc.set_defaults(func=_wordpress)
 
+    sh = sub.add_parser("shield", help="protection inside PHP: block exploits of the vulnerabilities this site "
+                                       "actually has (log-only until you promote rules)")
+    shs = sh.add_subparsers(dest="shield_cmd", required=True, parser_class=_Parser)
+    shp = shs.add_parser("policy", help="build a policy for the exploited vulnerabilities installed at PATH")
+    shp.add_argument("path", nargs="?", default=".", help="project or WordPress root (default: .)")
+    shp.add_argument("--out", help="policy file (default phpwarden-shield.policy.json; a .php twin is written too)")
+    shp.add_argument("--php-version", help="the production PHP version, for engine CVE rules")
+    shp.add_argument("--php-sapi", choices=["fpm", "cgi", "cli"], help="the production SAPI")
+    shp.add_argument("--log", help="where the agent should write its log (default: next to the agent)")
+    shp.add_argument("--json", action="store_true", help="print the policy as JSON")
+    shi = shs.add_parser("install", help="show how to load the agent (and copy it with --dest)")
+    shi.add_argument("--dest", metavar="DIR", help="copy phpwarden-shield.php into this folder")
+    shr = shs.add_parser("report", help="summarise the agent's log")
+    shr.add_argument("log", help="phpwarden-shield.log")
+    shr.add_argument("--json", action="store_true", help="machine-readable JSON output")
+    shm = shs.add_parser("promote", help="switch rules from logging to blocking after a clean burn-in")
+    shm.add_argument("policy", help="the policy JSON to update")
+    shm.add_argument("--log", required=True, help="the agent log covering the burn-in")
+    shm.add_argument("--rule", action="append", metavar="ID", help="only this rule (repeatable)")
+    shm.add_argument("--i-understand-this-blocks-requests", action="store_true",
+                     help="required: promoted rules return 403 to matching requests")
+    sh.set_defaults(func=_shield)
+
     asx = sub.add_parser("assess", help="one ranked verdict from every view: installed versions, your code, "
                                         "the live site from outside, and attacks in the access log")
     asx.add_argument("path", nargs="?", help="project or site root (composer.lock, WordPress, PHP code)")

{phpwarden-2.2.1 → phpwarden-2.3.0}/src/phpwarden/code.py

@@ -1099,8 +1099,15 @@ class FileScanner:
         ids = {t[1].lower() for t in rng if t[0] == "id"}
         if ids & UPLOAD_CHECKS:
             return True
+        # Validation rules that check the real file (Laravel "mimes:" / "image").
+        if any(t[0] in ("str", "dstr") and re.search(r"(?i)(?:^|\|)(?:image(?:\||$)|mimes:|mimetypes:|extensions:)", t[1] or "")
+               for t in rng):
+            return True
+        # An extension taken from the file name and compared with a list is a check.
+        # The client-supplied MIME type ($_FILES[..]['type'], getClientMimeType())
+        # is NOT: the browser, or an attacker, chooses it.
         ext = "pathinfo_extension" in ids or "strrchr" in ids or "strrpos" in ids or \
-            ("explode" in ids and "end" in ids) or any(t[0] in ("str", "dstr") and t[1] == "type" for t in rng)
+            ("explode" in ids and "end" in ids)
         cmp_ = "in_array" in ids or "preg_match" in ids or "switch" in ids or "match" in ids or \
             any(t[0] == "op" and t[1] in ("==", "===", "!=", "!==") for t in rng)
         return ext and cmp_
@@ -2061,7 +2068,104 @@ def _build_ext(sums, resolve):
             "exports": exports, "resolve": resolve}, seeds
 
 
-def scan_project(path, *, include_tests=False, lock_findings=None, rules=None, all_rules=False):
+DEFAULT_ENGINE = os.environ.get("PHPWARDEN_CODE_ENGINE", "auto")
+
+
+def _start_token_worker(path, tok_kw):
+    """Run the token pass in a separate Python process (plain subprocess: it never
+    re-runs the caller's script, unlike multiprocessing's spawn). None if the
+    arguments are not JSON-able or the process cannot start."""
+    import subprocess
+    import sys as _sys
+    try:
+        payload = json.dumps({"path": os.path.abspath(path), "kw": tok_kw})
+    except (TypeError, ValueError):
+        return None
+    pkg_parent = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+    env = dict(os.environ, PYTHONPATH=pkg_parent + os.pathsep + os.environ.get("PYTHONPATH", ""))
+    code_ = ("import json,sys;from phpwarden import code as c;a=json.loads(sys.stdin.read());"
+             "sys.stdout.write(json.dumps(c._scan_tokens(a['path'],**a['kw'])))")
+    try:
+        p = subprocess.Popen([_sys.executable, "-c", code_], stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+                             stderr=subprocess.DEVNULL, env=env)
+        p.stdin.write(payload.encode())
+        p.stdin.close()
+        return p
+    except OSError:
+        return None
+
+
+def _finish_token_worker(p):
+    try:
+        out = p.stdout.read()
+        if p.wait() != 0:
+            return None
+        return json.loads(out)
+    except (OSError, ValueError):
+        return None
+
+
+def _count_php(root, include_tests, limit):
+    n = 0
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS and (include_tests or d.lower() not in TEST_DIRS)]
+        n += sum(1 for f in filenames if f.endswith(PHP_EXTS))
+        if n >= limit:
+            break
+    return n
+
+
+def scan_project(path, *, include_tests=False, lock_findings=None, rules=None, all_rules=False, engine=None):
+    """engine: "tokens" (the token engine), "ast" (the whole-program AST taint
+    engine in phpwarden.sast for taint rules, token engine for pattern rules) or
+    "auto" (like "ast", but files the parser could not read cleanly keep their
+    token-engine taint findings). Default: DEFAULT_ENGINE."""
+    engine = engine or DEFAULT_ENGINE
+    # With the AST engine deciding the taint rules, the token engine only needs
+    # its per-file pass (pattern rules, and taint for files the parser could not
+    # read in "auto"); its project-wide rounds would be thrown away.
+    tok_kw = dict(include_tests=include_tests, lock_findings=lock_findings, rules=rules,
+                  all_rules=all_rules, rounds=(engine == "tokens"))
+    if engine == "tokens" or not os.path.isdir(os.path.abspath(path)):
+        return _scan_tokens(path, **tok_kw)
+    from phpwarden.sast import engine as _ast
+    enabled = set(rules) if rules else {r["id"] for r in RULES if all_rules or r.get("default", True)}
+    # The token pass and the AST analysis are independent: on a large project run
+    # the token pass in a second process while this one parses (its result is a
+    # small dict). Small projects, or no usable process pool, run it inline.
+    proc = None
+    if _count_php(path, include_tests, 400) >= 400:
+        proc = _start_token_worker(path, tok_kw)
+    import gc as _gc
+    _gc_was = _gc.isenabled()
+    _gc.disable()        # millions of long-lived AST nodes: generational GC only re-scans them
+    try:
+        found, handled, _p = _ast.analyse(path, include_tests=include_tests, enabled=enabled)
+    except Exception:  # noqa: BLE001  - never lose the scan to the new engine
+        found = None
+    finally:
+        _p = None
+        if _gc_was:
+            _gc.enable()
+    res = _finish_token_worker(proc) if proc is not None else None
+    if res is None:
+        res = _scan_tokens(path, **tok_kw)
+    if found is None:
+        return res
+    keep = [f for f in res["findings"]
+            if f["rule"] not in _ast.TAINT_RULES or (engine == "auto" and f["file"] not in handled)]
+    have = {(f["rule"], f["file"], f["line"]) for f in keep}
+    keep += [f for f in found if (f["rule"], f["file"], f["line"]) not in have]
+    keep.sort(key=lambda f: (SEV_RANK.get(f["severity"], 9), f["file"], f["line"], f["column"], f["rule"]))
+    res["findings"] = keep
+    res["summary"] = {s: 0 for s in SEVERITIES}
+    for f in keep:
+        res["summary"][f["severity"]] = res["summary"].get(f["severity"], 0) + 1
+    res["engine"] = engine
+    return res
+
+
+def _scan_tokens(path, *, include_tests=False, lock_findings=None, rules=None, all_rules=False, rounds=True):
     """rules: only these rule ids. all_rules: also run the opt-in rules that are
     off by default because they are noisy (see list_rules(): "default": false).
 
@@ -2103,7 +2207,7 @@ def scan_project(path, *, include_tests=False, lock_findings=None, rules=None, a
     # project-wide rounds
     prev_ext = {"wrap": {}, "tret": {}, "retp": {}, "uniq": set()}
     prev_exports, prev_seeds = {}, {}
-    for _round in range(MAX_ROUNDS if len(sums) > 1 else 0):
+    for _round in range(MAX_ROUNDS if len(sums) > 1 and rounds else 0):
         ext, seeds = _build_ext(sums, resolve)
         changed = set()
         # pass-through summaries (retp) are many and only matter one level deep
@@ -2204,8 +2308,11 @@ def scan_project(path, *, include_tests=False, lock_findings=None, rules=None, a
             "findings": findings, "summary": summary}
 
 
-def list_rules():
-    return [dict(r) for r in RULES]
+def list_rules(engine=None):
+    """Rules that run with the given engine (default: DEFAULT_ENGINE); the AST-only
+    rules are listed with engine="ast"/"auto"."""
+    engine = engine or DEFAULT_ENGINE
+    return [dict(r) for r in RULES if engine in ("ast", "auto") or r.get("engine", "any") != "ast"]
 
 
 def exit_code(result):
@@ -2237,7 +2344,10 @@ _SEC_SCORE = {"critical": "9.5", "high": "8.0", "medium": "5.5", "low": "3.0"}
 def to_sarif(result):
     rules = []
     index = {}
-    for i, r in enumerate(RULES):
+    eng = result.get("engine", DEFAULT_ENGINE)
+    used = {f.get("rule") for f in result.get("findings", [])}
+    listed = [r for r in RULES if eng in ("ast", "auto") or r.get("engine", "any") != "ast" or r["id"] in used]
+    for i, r in enumerate(listed):
         index[r["id"]] = i
         rules.append({"id": r["id"], "name": r["id"].replace("-", "_"),
                       "shortDescription": {"text": r["title"]},
@@ -2256,6 +2366,12 @@ def to_sarif(result):
                             "region": {"startLine": f["line"], "startColumn": f["column"],
                                        "snippet": {"text": f["snippet"]}}}}],
                         "properties": {"severity": f["severity"], "cwe": f["cwe"], "context": f.get("context") or []}})
+        if f.get("trace"):
+            results[-1]["codeFlows"] = [{"threadFlows": [{"locations": [
+                {"location": {"physicalLocation": {"artifactLocation": {"uri": h["file"], "uriBaseId": "%SRCROOT%"},
+                                                   "region": {"startLine": h["line"],
+                                                              "startColumn": max(1, h.get("column") or 1)}},
+                              "message": {"text": h["note"]}}} for h in f["trace"]]}]}]
     return {"$schema": "https://json.schemastore.org/sarif-2.1.0.json", "version": "2.1.0",
             "runs": [{"tool": {"driver": {"name": "phpwarden-code", "version": result["version"],
                                           "informationUri": "https://phpwarden.io", "rules": rules}},

{phpwarden-2.2.1 → phpwarden-2.3.0}/src/phpwarden/code_rules.py

@@ -15,10 +15,11 @@ SEVERITIES = ("critical", "high", "medium", "low")
 RULES = []
 
 
-def _r(rid, cat, sev, cwe, title, desc, fix, default=True):
-    """default=False: an opt-in rule, run only when selected by id or with all_rules."""
+def _r(rid, cat, sev, cwe, title, desc, fix, default=True, engine="any"):
+    """default=False: an opt-in rule, run only when selected by id or with all_rules.
+    engine="ast": the rule needs the whole-program engine (engine="ast"/"auto")."""
     RULES.append({"id": rid, "category": cat, "severity": sev, "cwe": cwe,
-                  "title": title, "description": desc, "fix": fix, "default": default})
+                  "title": title, "description": desc, "fix": fix, "default": default, "engine": engine})
 
 
 # --- code execution ---------------------------------------------------------
@@ -280,6 +281,36 @@ _r("xxe-xmlreader-subst", C, "high", "CWE-611", "XMLReader entity substitution e
    "XMLReader::SUBST_ENTITIES set to true enables XXE.",
    "Do not enable SUBST_ENTITIES.")
 
+# --- found by the AST engine (whole-program taint + framework models) --------
+C = "framework"
+_r("mass-assignment", C, "high", "CWE-915", "Whole request mass-assigned to an Eloquent model",
+   "The complete request ($request->all(), except(), input()) is passed to create()/fill()/update() on a model "
+   "with $guarded = [] (or through forceFill/forceCreate), so a request can set any column, e.g. is_admin.",
+   "Pass $request->validated() or $request->only([...]) with an explicit list, and declare $fillable.", engine="ast")
+_r("blade-raw", "xss", "medium", "CWE-79", "Request data printed unescaped in a Blade template",
+   "A value that comes from the request reaches {!! ... !!} in a Blade view, which prints it without escaping.",
+   "Use {{ ... }} (escaped), or sanitize with clean()/strip_tags before using {!! !!}.", engine="ast")
+_r("twig-raw", "xss", "medium", "CWE-79", "Request data printed with |raw in a Twig template",
+   "A value that comes from the request is printed with the |raw filter or inside {% autoescape false %}.",
+   "Remove |raw, or sanitize the value (e.g. with an HTML sanitizer) before rendering.", engine="ast")
+_r("xss-response", "xss", "medium", "CWE-79", "Request data returned as an HTML response body",
+   "Request data is the body of a Response with the default text/html content type.",
+   "Escape the value, return JSON (JsonResponse/response()->json()), or set a non-HTML Content-Type.", engine="ast")
+_r("ssrf-http-client", "ssrf", "high", "CWE-918", "User-controlled URL in an HTTP client request",
+   "A request value is used as the URL of a Guzzle / Symfony HttpClient / PSR-18 request (server-side request forgery).",
+   "Allow-list hosts and schemes before requesting a URL that comes from the request.", engine="ast")
+_r("cmd-process", "command-injection", "critical", "CWE-78", "User input in a shell command line (Process)",
+   "Request data is part of a command string given to Process::fromShellCommandline(), new Process(string) or "
+   "Laravel's Process::run(), which runs it through a shell.",
+   "Pass the command as an array of arguments (new Process(['cmd', $arg])) and validate each value.", engine="ast")
+_r("mail-header-injection", "injection", "medium", "CWE-93", "User input in mail headers",
+   "Request data is used in the headers argument of mail()/wp_mail(); a newline lets an attacker add headers.",
+   "Never build mail headers from request data; strip CR/LF and validate addresses.", engine="ast")
+_r("wp-option-key-tainted", "wordpress", "high", "CWE-15", "Request data chooses which option or meta key is written",
+   "update_option()/update_user_meta() and similar are called with a key taken from the request, so a request can "
+   "overwrite any setting (e.g. users_can_register, default_role, wp_capabilities).",
+   "Map allowed keys from a fixed list; never use a request value as the option or meta name.", engine="ast")
+
 RULES_BY_ID = {r["id"]: r for r in RULES}
 
 # ---------------------------------------------------------------------------
@@ -367,3 +398,42 @@ GADGET_PACKAGES = [
     "cakephp/cakephp", "thinkphp/", "topthink/framework", "drupal/core",
     "phpseclib/phpseclib", "pear/archive_tar", "wordpress/",
 ]
+
+
+# --- layer 5 (whole-program engine) -------------------------------------------
+C = "second-order"
+_r("second-order-injection", C, "high", "CWE-74", "Stored request data used later in a sink (second-order)",
+   "Request data is saved under a fixed option or meta key and read back elsewhere, where it reaches a SQL query, "
+   "HTML output, an include or another sink without being sanitised for that use.",
+   "Sanitise when the value is used, not only when it is stored: prepare SQL, escape output, whitelist paths.",
+   engine="ast")
+C = "authorization"
+_r("laravel-route-no-auth", C, "medium", "CWE-862", "State-changing route with no authentication or authorization",
+   "A POST/PUT/PATCH/DELETE route reaches a database write, but neither the route (or its group) has auth "
+   "middleware nor does the controller call authorize() or a Gate.",
+   "Add ->middleware('auth') (or 'can:...') to the route or group, or call $this->authorize() in the controller.",
+   engine="ast")
+_r("symfony-route-no-auth", C, "medium", "CWE-862", "Controller action writes entities with no access check",
+   "A #[Route] action persists or removes entities without #[IsGranted] or denyAccessUnlessGranted().",
+   "Add #[IsGranted('ROLE_...')] or call $this->denyAccessUnlessGranted(); or cover the path in access_control.",
+   engine="ast")
+_r("laravel-idor-hint", C, "medium", "CWE-639", "Record from a route parameter changed without an ownership check",
+   "An authenticated route loads a model from a route parameter and updates or deletes it, with no policy, Gate "
+   "or ownership comparison, so one user may change another user's record (IDOR).",
+   "Authorize with a policy ($this->authorize('update', $post)) or scope the query to the current user.",
+   engine="ast")
+C = "csrf"
+_r("laravel-csrf-excluded", C, "medium", "CWE-352", "State-changing route excluded from CSRF protection",
+   "A URI in VerifyCsrfToken::$except (or validateCsrfTokens(except: ...)) matches a POST/PUT/PATCH/DELETE web "
+   "route, so another site can submit it on behalf of a signed-in user.",
+   "Remove it from the exception list, or verify the caller another way (a webhook signature).",
+   engine="ast")
+_r("wp-admin-post-no-nonce", C, "medium", "CWE-352", "admin-post handler changes state without a nonce check",
+   "An admin_post_ action handler writes options, posts or the database without check_admin_referer() or "
+   "wp_verify_nonce(), so another site can trigger it for a logged-in administrator.",
+   "Add a nonce to the form and call check_admin_referer('action') at the top of the handler.",
+   engine="ast")
+
+
+# rules appended after the table above (Stage C) must be indexed too
+RULES_BY_ID.update({r["id"]: r for r in RULES})

phpwarden-2.3.0/src/phpwarden/sast/__init__.py

@@ -0,0 +1,10 @@
+"""phpwarden SAST engine: PHP 8.3 parser (layer 1) and whole-program model (layer 2).
+
+    from phpwarden.sast import parse, Project
+    res = parse(open("x.php", encoding="latin-1").read(), "x.php")
+    proj = Project.load("/path/to/app")
+
+See README.md in this directory for the data model.
+"""
+from .parser import parse, parse_file, ParseError, ParseResult  # noqa: F401
+from .ast import Node, walk, find, dump  # noqa: F401