Add taint-based Davidson Semgrep rules

2026-09-08 20:58:11 +01:00
parent 664fbcfc63
commit b95ae6e079
2 changed files with 37 additions and 0 deletions
@@ -0,0 +1,36 @@
+rules:
+  - id: php-user-input-eval
+    languages: [php]
+    severity: ERROR
+    message: Untrusted request input reaches eval(), which can lead to remote code execution.
+    mode: taint
+
+    pattern-sources:
+      - pattern-either:
+          - pattern: $_GET[$KEY]
+          - pattern: $_POST[$KEY]
+          - pattern: $_REQUEST[$KEY]
+          - pattern: $_COOKIE[$KEY]
+
+    pattern-sinks:
+      - pattern: eval($DATA)
+
+  - id: php-user-input-command-execution
+    languages: [php]
+    severity: ERROR
+    message: Untrusted request input reaches an operating-system command execution function.
+    mode: taint
+
+    pattern-sources:
+      - pattern-either:
+          - pattern: $_GET[$KEY]
+          - pattern: $_POST[$KEY]
+          - pattern: $_REQUEST[$KEY]
+          - pattern: $_COOKIE[$KEY]
+
+    pattern-sinks:
+      - pattern-either:
+          - pattern: system($DATA)
+          - pattern: exec($DATA)
+          - pattern: shell_exec($DATA)
+          - pattern: passthru($DATA)