phpwarden 2.3.0__tar.gz → 2.4.0__tar.gz

{phpwarden-2.3.0/src/phpwarden.egg-info → phpwarden-2.4.0}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: phpwarden
-Version: 2.3.0
-Summary: PHP vulnerability scanner for the PHP engine, Composer, WordPress, your own code and the live site. Ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero dependencies.
+Version: 2.4.0
+Summary: PHP vulnerability scanner for the PHP engine, Composer, WordPress, your own code and the live site. Ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS; blocks exploits inside PHP (shield). Offline, zero dependencies.
 Author: oroma-alfred
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://phpwarden.io
 Project-URL: Source, https://github.com/oroma-alfred/phpwarden
 Project-URL: Issues, https://github.com/oroma-alfred/phpwarden/issues
-Keywords: php,composer,wordpress,php-fpm,security,vulnerability,cve,kev,epss,sca,scanner
+Keywords: php,composer,wordpress,php-fpm,security,vulnerability,cve,kev,epss,sca,sast,waf,scanner
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: System Administrators
@@ -28,8 +28,9 @@ exploited (CISA KEV, as of 2026-11-14). phpwarden puts those first, then sorts
 by EPSS probability, then CVSS — so a `composer.lock` with 30 findings tells
 you which one to fix today.
 
-It scans the PHP engine/FPM version, Composer dependencies and WordPress
-installs against one bundled, offline advisory feed. Zero runtime dependencies
+It scans the PHP engine/FPM version, Composer dependencies, WordPress installs
+and your own PHP code, checks live sites from outside, and can block exploits
+inside PHP, against one bundled, offline advisory feed. Zero runtime dependencies
 (Python 3.8+), Apache-2.0.
 
 **Reproducible benchmark:** on four real PHP stacks, phpwarden found 295 of 295
@@ -144,7 +145,26 @@ error, `5` `--report-to` upload failed on an otherwise clean run, `64` usage
 error. Full table: `phpwarden --help`.
 
 
-## New in 2.3.0 and 2.2
+## New in 2.4.0, 2.3.0 and 2.2
+
+- **2.4.0: `phpwarden code` follows data through the database and callbacks.**
+  Request data saved with raw SQL, `$wpdb`, Eloquent, the query builder or
+  Doctrine and read back from the same table is traced to where it is printed
+  or queried (stored XSS, second-order SQL injection), and callbacks passed to
+  `array_map`, `usort`, `preg_replace_callback`, `add_filter` and the like,
+  `$f()` and first-class callables are followed. DVWA: 8/8/7 of 8 types under
+  the comparison's scorer (was 7/7/6); clean-code counts unchanged.
+- **2.4.0: shield rate limits.** Per-client limits on WordPress login, password
+  reset, xmlrpc and `system.multicall`, Laravel login and reset, component
+  writes, and a burst guard. Log-only until promoted, then 429; APCu or file
+  store; fails open. `--trust-proxy CIDR`, `--no-limits`, `--limit-path REGEX`.
+  0 trips on 6,000 ordinary requests; 6 of 6 abuse scenarios caught. Pairing
+  with Cloudflare or nginx: [EDGE.md](src/phpwarden/shield/EDGE.md).
+- **2.4.0: `phpwarden trivy-import` and `assess --trivy FILE` / `--run-trivy`.**
+  Trivy's JSON (npm/JS, OS packages, images, IaC, secrets) in the same ranked
+  list as PHP findings: KEV, then EPSS (`--kev`, `--epss`), then severity.
+  Secrets by file and line only. Never downloads Trivy. See
+  [src/phpwarden/thirdparty/README.md](src/phpwarden/thirdparty/README.md).
 
 - **`phpwarden probe URL`**: a live check of a running site using GET and HEAD
   requests only. It looks for exposed files (`.env`, `.git`, backups), open debug
@@ -161,7 +181,6 @@ error. Full table: `phpwarden --help`.
   Follows data stored in the session or WordPress options (second-order).
   89 rules. On the same pinned apps it found more than Semgrep and Psalm with far
   fewer findings on clean framework code ([comparison](https://github.com/oroma-alfred/phpwarden/tree/main/bench/sast-compare-2026-11)).
-  Data that round-trips through the database is not followed.
 - **`phpwarden shield`**: one PHP file loaded before your app that blocks exploit
   attempts against the exploited vulnerabilities this site actually has, scoped
   to their entry points. Logs until you promote rules (7-day burn-in, explicit
@@ -248,7 +267,7 @@ see [phpwarden/laravel](https://packagist.org/packages/phpwarden/laravel).
 ```yaml
 repos:
   - repo: https://github.com/oroma-alfred/phpwarden
-    rev: v2.3.0        # pin to a tag with `pre-commit autoupdate`
+    rev: v2.4.0        # pin to a tag with `pre-commit autoupdate`
     hooks:
       - id: phpwarden-deps
         # args: ["--no-reachability"]   # faster: skip the reachability pass
@@ -259,14 +278,14 @@ timer recipes are in [`docs/recipes.md`](docs/recipes.md).
 
 ## The feed
 
-The bundled community feed (2026.11.13.3 in this release) works forever, offline:
+The bundled community feed (2026.11.14.2 in this release) works forever, offline:
 
 - **~21,300 advisories**: ~8,800 Composer (from [OSV.dev](https://osv.dev) and
   [FriendsOfPHP](https://github.com/FriendsOfPHP/security-advisories)),
   ~12,300 WordPress (from [NVD](https://nvd.nist.gov): plugin, core and theme),
-  and 145 PHP engine/FPM CVEs, including hand-curated entries with per-branch
-  fixed versions, exposure conditions and detection signatures. About 19,700 carry an
-  EPSS score; 41 distinct vulnerabilities were in KEV when this feed was built.
+  and 146 PHP engine/FPM CVEs, including hand-curated entries with per-branch
+  fixed versions, exposure conditions and detection signatures. About 19,800 carry an
+  EPSS score; 54 distinct vulnerabilities were in KEV when this feed was built.
 - **License-independent by construction.** Every source is open or
   public-domain (OSV, NVD, FriendsOfPHP, php-src release notes, CISA KEV, FIRST EPSS). No commercial
   vendor's feed is used, so coverage cannot be revoked or priced away.

phpwarden-2.3.0/PKG-INFO → phpwarden-2.4.0/README.md

@@ -1,25 +1,3 @@
-Metadata-Version: 2.4
-Name: phpwarden
-Version: 2.3.0
-Summary: PHP vulnerability scanner for the PHP engine, Composer, WordPress, your own code and the live site. Ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero dependencies.
-Author: oroma-alfred
-License-Expression: Apache-2.0
-Project-URL: Homepage, https://phpwarden.io
-Project-URL: Source, https://github.com/oroma-alfred/phpwarden
-Project-URL: Issues, https://github.com/oroma-alfred/phpwarden/issues
-Keywords: php,composer,wordpress,php-fpm,security,vulnerability,cve,kev,epss,sca,scanner
-Classifier: Development Status :: 4 - Beta
-Classifier: Environment :: Console
-Classifier: Intended Audience :: System Administrators
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Topic :: Security
-Classifier: Topic :: System :: Monitoring
-Requires-Python: >=3.8
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Dynamic: license-file
-
 # phpwarden
 
 **PHP vulnerability scanner that ranks findings by real-world exploitation,
@@ -28,8 +6,9 @@ exploited (CISA KEV, as of 2026-11-14). phpwarden puts those first, then sorts
 by EPSS probability, then CVSS — so a `composer.lock` with 30 findings tells
 you which one to fix today.
 
-It scans the PHP engine/FPM version, Composer dependencies and WordPress
-installs against one bundled, offline advisory feed. Zero runtime dependencies
+It scans the PHP engine/FPM version, Composer dependencies, WordPress installs
+and your own PHP code, checks live sites from outside, and can block exploits
+inside PHP, against one bundled, offline advisory feed. Zero runtime dependencies
 (Python 3.8+), Apache-2.0.
 
 **Reproducible benchmark:** on four real PHP stacks, phpwarden found 295 of 295
@@ -144,7 +123,26 @@ error, `5` `--report-to` upload failed on an otherwise clean run, `64` usage
 error. Full table: `phpwarden --help`.
 
 
-## New in 2.3.0 and 2.2
+## New in 2.4.0, 2.3.0 and 2.2
+
+- **2.4.0: `phpwarden code` follows data through the database and callbacks.**
+  Request data saved with raw SQL, `$wpdb`, Eloquent, the query builder or
+  Doctrine and read back from the same table is traced to where it is printed
+  or queried (stored XSS, second-order SQL injection), and callbacks passed to
+  `array_map`, `usort`, `preg_replace_callback`, `add_filter` and the like,
+  `$f()` and first-class callables are followed. DVWA: 8/8/7 of 8 types under
+  the comparison's scorer (was 7/7/6); clean-code counts unchanged.
+- **2.4.0: shield rate limits.** Per-client limits on WordPress login, password
+  reset, xmlrpc and `system.multicall`, Laravel login and reset, component
+  writes, and a burst guard. Log-only until promoted, then 429; APCu or file
+  store; fails open. `--trust-proxy CIDR`, `--no-limits`, `--limit-path REGEX`.
+  0 trips on 6,000 ordinary requests; 6 of 6 abuse scenarios caught. Pairing
+  with Cloudflare or nginx: [EDGE.md](src/phpwarden/shield/EDGE.md).
+- **2.4.0: `phpwarden trivy-import` and `assess --trivy FILE` / `--run-trivy`.**
+  Trivy's JSON (npm/JS, OS packages, images, IaC, secrets) in the same ranked
+  list as PHP findings: KEV, then EPSS (`--kev`, `--epss`), then severity.
+  Secrets by file and line only. Never downloads Trivy. See
+  [src/phpwarden/thirdparty/README.md](src/phpwarden/thirdparty/README.md).
 
 - **`phpwarden probe URL`**: a live check of a running site using GET and HEAD
   requests only. It looks for exposed files (`.env`, `.git`, backups), open debug
@@ -161,7 +159,6 @@ error. Full table: `phpwarden --help`.
   Follows data stored in the session or WordPress options (second-order).
   89 rules. On the same pinned apps it found more than Semgrep and Psalm with far
   fewer findings on clean framework code ([comparison](https://github.com/oroma-alfred/phpwarden/tree/main/bench/sast-compare-2026-11)).
-  Data that round-trips through the database is not followed.
 - **`phpwarden shield`**: one PHP file loaded before your app that blocks exploit
   attempts against the exploited vulnerabilities this site actually has, scoped
   to their entry points. Logs until you promote rules (7-day burn-in, explicit
@@ -248,7 +245,7 @@ see [phpwarden/laravel](https://packagist.org/packages/phpwarden/laravel).
 ```yaml
 repos:
   - repo: https://github.com/oroma-alfred/phpwarden
-    rev: v2.3.0        # pin to a tag with `pre-commit autoupdate`
+    rev: v2.4.0        # pin to a tag with `pre-commit autoupdate`
     hooks:
       - id: phpwarden-deps
         # args: ["--no-reachability"]   # faster: skip the reachability pass
@@ -259,14 +256,14 @@ timer recipes are in [`docs/recipes.md`](docs/recipes.md).
 
 ## The feed
 
-The bundled community feed (2026.11.13.3 in this release) works forever, offline:
+The bundled community feed (2026.11.14.2 in this release) works forever, offline:
 
 - **~21,300 advisories**: ~8,800 Composer (from [OSV.dev](https://osv.dev) and
   [FriendsOfPHP](https://github.com/FriendsOfPHP/security-advisories)),
   ~12,300 WordPress (from [NVD](https://nvd.nist.gov): plugin, core and theme),
-  and 145 PHP engine/FPM CVEs, including hand-curated entries with per-branch
-  fixed versions, exposure conditions and detection signatures. About 19,700 carry an
-  EPSS score; 41 distinct vulnerabilities were in KEV when this feed was built.
+  and 146 PHP engine/FPM CVEs, including hand-curated entries with per-branch
+  fixed versions, exposure conditions and detection signatures. About 19,800 carry an
+  EPSS score; 54 distinct vulnerabilities were in KEV when this feed was built.
 - **License-independent by construction.** Every source is open or
   public-domain (OSV, NVD, FriendsOfPHP, php-src release notes, CISA KEV, FIRST EPSS). No commercial
   vendor's feed is used, so coverage cannot be revoked or priced away.

{phpwarden-2.3.0 → phpwarden-2.4.0}/pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phpwarden"
-version = "2.3.0"
-description = "PHP vulnerability scanner for the PHP engine, Composer, WordPress, your own code and the live site. Ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero dependencies."
+version = "2.4.0"
+description = "PHP vulnerability scanner for the PHP engine, Composer, WordPress, your own code and the live site. Ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS; blocks exploits inside PHP (shield). Offline, zero dependencies."
 readme = "README.md"
 requires-python = ">=3.8"
 license = "Apache-2.0"
 license-files = ["LICENSE"]
 authors = [{ name = "oroma-alfred" }]
-keywords = ["php", "composer", "wordpress", "php-fpm", "security", "vulnerability", "cve", "kev", "epss", "sca", "scanner"]
+keywords = ["php", "composer", "wordpress", "php-fpm", "security", "vulnerability", "cve", "kev", "epss", "sca", "sast", "waf", "scanner"]
 classifiers = [
     "Development Status :: 4 - Beta",
     "Environment :: Console",
@@ -39,4 +39,4 @@ package-dir = { "" = "src" }
 where = ["src"]
 
 [tool.setuptools.package-data]
-phpwarden = ["data/*.json", "shield/agent/*.php"]
+phpwarden = ["data/*.json", "shield/agent/*.php", "shield/*.md"]

{phpwarden-2.3.0 → phpwarden-2.4.0}/src/phpwarden/__init__.py

@@ -6,4 +6,4 @@ real-world exploitation (CISA KEV, then EPSS, then CVSS), and can watch PHP-FPM
 for active exploitation. The engine and the bundled feed are open; free users
 get weekly feed updates, and a subscription adds the feed rebuilt twice a day.
 """
-__version__ = "2.3.0"
+__version__ = "2.4.0"

{phpwarden-2.3.0 → phpwarden-2.4.0}/src/phpwarden/cli.py

@@ -546,8 +546,29 @@ def _assess(args):
         if any("homepage unreachable" in n for n in probe_result.get("notes", [])):
             sys.stderr.write(f"error: could not reach {url}\n")
             return 4
+    trivy_fs, trivy_note = None, None
+    if args.trivy or args.run_trivy:
+        from phpwarden.thirdparty import trivy as tv
+        try:
+            kev, epss = tv.load_kev(args.kev), tv.load_epss(args.epss)
+            docs = [tv.load_report(f) for f in (args.trivy or [])]
+        except (OSError, ValueError) as e:
+            sys.stderr.write(f"error: {e}\n")
+            return 4
+        if args.run_trivy and args.path:
+            doc, msg = tv.run_trivy_fs(args.path)
+            if doc is not None:
+                docs.append(doc)
+            else:
+                trivy_note = msg
+                sys.stderr.write(msg + "\n")
+        trivy_fs = [f for d in docs for f in tv.findings(d, kev, epss)]
+        if docs and not (args.kev or args.epss):
+            trivy_note = (trivy_note + "; " if trivy_note else "") + \
+                "non-PHP findings ranked by severity only (pass --kev and --epss for exploitation data)"
     try:
-        res = vd.assess(args.path, probe_result=probe_result, logfile=args.log, run_code=not args.no_code)
+        res = vd.assess(args.path, probe_result=probe_result, logfile=args.log, run_code=not args.no_code,
+                        trivy_findings=trivy_fs, trivy_note=trivy_note)
     except OSError as e:                      # unreadable access log
         sys.stderr.write(f"error: {e}\n")
         return 4
@@ -563,6 +584,31 @@ def _assess(args):
     return vd.exit_code(res)
 
 
+def _trivy_import(args):
+    from phpwarden.thirdparty import trivy as tv
+    try:
+        kev, epss = tv.load_kev(args.kev), tv.load_epss(args.epss)
+        fs = [f for p in args.files for f in tv.findings(tv.load_report(p), kev, epss)]
+    except (OSError, ValueError) as e:
+        sys.stderr.write(f"error: {e}\n")
+        return 4
+    doc = tv.to_report_doc(fs, args.files)
+    if args.json:
+        print(json.dumps(doc, indent=2))
+    else:
+        kev_n = sum(1 for f in fs if f["known_exploited"])
+        print(f"{len(fs)} finding(s) from {len(args.files)} Trivy report(s); {kev_n} known exploited. "
+              f"Ranked by exploitation{'' if (args.kev or args.epss) else ' (no --kev/--epss: by severity)'}:")
+        for f in fs[:50]:
+            tag = " [KEV]" if f["known_exploited"] else (f" [EPSS {f['epss'] * 100:.0f}%]" if f.get("epss") else "")
+            dev = " (dev)" if f["dev"] else ""
+            print(f"  {f['severity']:<8} {tv.ident(f)}{tag}{dev}  {f['title'][:90]}")
+        if len(fs) > 50:
+            print(f"  ... and {len(fs) - 50} more; use --json for all")
+    rc = 1 if any(f["known_exploited"] or f["severity"] in ("critical", "high") for f in fs) else 0
+    return _combine(rc, _maybe_report(args, doc))
+
+
 def _shield(args):
     from pathlib import Path as _P
     from phpwarden.shield import policy as sp, report as sr
@@ -572,7 +618,9 @@ def _shield(args):
             sys.stderr.write(f"error: not a directory: {args.path}\n")
             return 4
         pol = sp.build_policy_for_path(str(root), FeedManager().current(), php_version=args.php_version,
-                                       php_sapi=args.php_sapi, log_path=args.log)
+                                       php_sapi=args.php_sapi, log_path=args.log,
+                                       limits=not args.no_limits, limit_paths=args.limit_path or [],
+                                       trust_proxy=args.trust_proxy or [])
         out = args.out or "phpwarden-shield.policy.json"
         j, php = sp.write_policy(pol, out)
         if args.json:
@@ -754,6 +802,15 @@ def main(argv=None):
     _report_args(wpc)
     wpc.set_defaults(func=_wordpress)
 
+    tvi = sub.add_parser("trivy-import", help="read Trivy JSON reports (npm/JS, OS packages, images, IaC), "
+                                              "rank them by exploitation, optionally send them to the dashboard")
+    tvi.add_argument("files", nargs="+", metavar="TRIVY_JSON", help="output of trivy fs/image/config --format json")
+    tvi.add_argument("--kev", metavar="FILE", help="CISA KEV catalogue JSON")
+    tvi.add_argument("--epss", metavar="FILE", help="FIRST EPSS CSV (.csv or .csv.gz)")
+    tvi.add_argument("--json", action="store_true", help="machine-readable JSON output")
+    _report_args(tvi)
+    tvi.set_defaults(func=_trivy_import)
+
     sh = sub.add_parser("shield", help="protection inside PHP: block exploits of the vulnerabilities this site "
                                        "actually has (log-only until you promote rules)")
     shs = sh.add_subparsers(dest="shield_cmd", required=True, parser_class=_Parser)
@@ -763,6 +820,12 @@ def main(argv=None):
     shp.add_argument("--php-version", help="the production PHP version, for engine CVE rules")
     shp.add_argument("--php-sapi", choices=["fpm", "cgi", "cli"], help="the production SAPI")
     shp.add_argument("--log", help="where the agent should write its log (default: next to the agent)")
+    shp.add_argument("--no-limits", action="store_true",
+                     help="leave out the rate limits (login, password reset, xmlrpc, burst guard)")
+    shp.add_argument("--limit-path", action="append", metavar="REGEX",
+                     help="also rate-limit requests to this path (repeatable)")
+    shp.add_argument("--trust-proxy", action="append", metavar="CIDR",
+                     help="trust forwarded client IPs only from this proxy range, e.g. your CDN (repeatable)")
     shp.add_argument("--json", action="store_true", help="print the policy as JSON")
     shi = shs.add_parser("install", help="show how to load the agent (and copy it with --dest)")
     shi.add_argument("--dest", metavar="DIR", help="copy phpwarden-shield.php into this folder")
@@ -789,6 +852,12 @@ def main(argv=None):
     asx.add_argument("--baseline", metavar="FILE",
                      help="an earlier --out file: report what is fixed and verified, still open, and new")
     asx.add_argument("--json", action="store_true", help="machine-readable JSON output")
+    asx.add_argument("--trivy", metavar="FILE", action="append",
+                     help="add a Trivy JSON report (npm/JS, OS packages, images, IaC); repeatable")
+    asx.add_argument("--run-trivy", action="store_true",
+                     help="run `trivy fs` on the path if Trivy is installed (never downloads it)")
+    asx.add_argument("--kev", metavar="FILE", help="CISA KEV catalogue JSON, to rank non-PHP CVEs by exploitation")
+    asx.add_argument("--epss", metavar="FILE", help="FIRST EPSS CSV (.csv or .csv.gz) for non-PHP CVEs")
     asx.set_defaults(func=_assess)
 
     cd = sub.add_parser("code", help="scan your own PHP code for high-signal security bugs "