mcp-server-semgrep/semgrep-rules/php/lang/security/injection/tainted-exec.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: tainted-exec
  languages:
  - php
  severity: WARNING
  message: >-
    User input is passed to a function that executes a shell command. This can lead to remote code execution.
  metadata:
    cwe:
    - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
    category: security
    technology:
    - php
    owasp:
    - A03:2021 - Injection
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    subcategory:
    - vuln
    impact: HIGH
    likelihood: MEDIUM
    confidence: MEDIUM
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: $_GET
      - pattern: $_POST
      - pattern: $_COOKIE
      - pattern: $_REQUEST
      - pattern: file_get_contents('php://input')
  pattern-sanitizers:
  - patterns:
    - pattern-either:
      - pattern: escapeshellcmd(...)
      - pattern: escapeshellarg(...)
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: exec(...)
      - pattern: system(...)
      - pattern: passthru(...)
      - patterns:
        - pattern: proc_open(...)
        - pattern-not: proc_open([...], ...)
      - pattern: popen(...)
      - pattern: expect_popen(...)
      - pattern: shell_exec(...)
      - pattern: |
          `...`