Add taint-based Davidson Semgrep rules

modules/security.sh

@@ -63,6 +63,7 @@ echo "→ Semgrep"
 
 if semgrep scan \
     --config=p/security-audit \
+    --config=.davidson-ci/semgrep/davidson.yml \
     --error \
     --exclude=node_modules \
     --exclude=vendor \

semgrep/davidson.yml

@@ -0,0 +1,36 @@
+rules:
+  - id: php-user-input-eval
+    languages: [php]
+    severity: ERROR
+    message: Untrusted request input reaches eval(), which can lead to remote code execution.
+    mode: taint
+
+    pattern-sources:
+      - pattern-either:
+          - pattern: $_GET[$KEY]
+          - pattern: $_POST[$KEY]
+          - pattern: $_REQUEST[$KEY]
+          - pattern: $_COOKIE[$KEY]
+
+    pattern-sinks:
+      - pattern: eval($DATA)
+
+  - id: php-user-input-command-execution
+    languages: [php]
+    severity: ERROR
+    message: Untrusted request input reaches an operating-system command execution function.
+    mode: taint
+
+    pattern-sources:
+      - pattern-either:
+          - pattern: $_GET[$KEY]
+          - pattern: $_POST[$KEY]
+          - pattern: $_REQUEST[$KEY]
+          - pattern: $_COOKIE[$KEY]
+
+    pattern-sinks:
+      - pattern-either:
+          - pattern: system($DATA)
+          - pattern: exec($DATA)
+          - pattern: shell_exec($DATA)
+          - pattern: passthru($DATA)