From b95ae6e07995739e22efa08299ce848ddf50b82d Mon Sep 17 00:00:00 2001
From: Pauljd <pauljd720@gmail.com>
Date: Tue, 8 Sep 2026 20:58:11 +0100
Subject: [PATCH] Add taint-based Davidson Semgrep rules

---
 modules/security.sh  |  1 +
 semgrep/davidson.yml | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 semgrep/davidson.yml

diff --git a/modules/security.sh b/modules/security.sh
index 47e9013..26159ab 100755
--- a/modules/security.sh
+++ b/modules/security.sh
@@ -63,6 +63,7 @@ echo "→ Semgrep"
 
 if semgrep scan \
     --config=p/security-audit \
+    --config=.davidson-ci/semgrep/davidson.yml \
     --error \
     --exclude=node_modules \
     --exclude=vendor \
diff --git a/semgrep/davidson.yml b/semgrep/davidson.yml
new file mode 100644
index 0000000..3296277
--- /dev/null
+++ b/semgrep/davidson.yml
@@ -0,0 +1,36 @@
+rules:
+  - id: php-user-input-eval
+    languages: [php]
+    severity: ERROR
+    message: Untrusted request input reaches eval(), which can lead to remote code execution.
+    mode: taint
+
+    pattern-sources:
+      - pattern-either:
+          - pattern: $_GET[$KEY]
+          - pattern: $_POST[$KEY]
+          - pattern: $_REQUEST[$KEY]
+          - pattern: $_COOKIE[$KEY]
+
+    pattern-sinks:
+      - pattern: eval($DATA)
+
+  - id: php-user-input-command-execution
+    languages: [php]
+    severity: ERROR
+    message: Untrusted request input reaches an operating-system command execution function.
+    mode: taint
+
+    pattern-sources:
+      - pattern-either:
+          - pattern: $_GET[$KEY]
+          - pattern: $_POST[$KEY]
+          - pattern: $_REQUEST[$KEY]
+          - pattern: $_COOKIE[$KEY]
+
+    pattern-sinks:
+      - pattern-either:
+          - pattern: system($DATA)
+          - pattern: exec($DATA)
+          - pattern: shell_exec($DATA)
+          - pattern: passthru($DATA)