rules:
  - id: php-user-input-eval
    languages: [php]
    severity: ERROR
    message: Untrusted request input reaches eval(), which can lead to remote code execution.
    mode: taint

    pattern-sources:
      - pattern-either:
          - pattern: $_GET[$KEY]
          - pattern: $_POST[$KEY]
          - pattern: $_REQUEST[$KEY]
          - pattern: $_COOKIE[$KEY]

    pattern-sinks:
      - pattern: eval($DATA)

  - id: php-user-input-command-execution
    languages: [php]
    severity: ERROR
    message: Untrusted request input reaches an operating-system command execution function.
    mode: taint

    pattern-sources:
      - pattern-either:
          - pattern: $_GET[$KEY]
          - pattern: $_POST[$KEY]
          - pattern: $_REQUEST[$KEY]
          - pattern: $_COOKIE[$KEY]

    pattern-sinks:
      - pattern-either:
          - pattern: system($DATA)
          - pattern: exec($DATA)
          - pattern: shell_exec($DATA)
          - pattern: passthru($DATA)