Sanctify-PHP

Haskell-based PHP hardening and security analysis tool.

Current Status

Sanctify-PHP already contains substantial parser, analysis, transform, and reporting code, but it should still be treated as a research or beta security tool.

• The implementation breadth is ahead of the verification depth.

• The most important remaining gaps are taint-analysis tests, end-to-end execution coverage, and proof obligations for the security-analysis core.

• Use ROADMAP.adoc, TEST-NEEDS.md, and PROOF-NEEDS.md as the primary readiness documents.

Overview

Sanctify-PHP transforms PHP code to be safer and more robust:

• Adds declare(strict_types=1) declarations

• Infers and adds type hints

• Detects security vulnerabilities (SQLi, XSS, CSRF, command injection)

• Enforces WordPress-specific constraints

• Performs taint tracking analysis

• Generates reports in JSON/SARIF/HTML formats

• Exports infrastructure recommendations (php.ini, nginx, Guix)

Note	This README describes the intended capability surface of the tool. It should not be read as proof that every analysis and transform is already trustworthy enough for production security decisions.

Installation

# Using Cabal
cabal build
cabal install
# Using Nix
nix build
# Using Guix
guix build -f guix.scm

Usage

# Analyze files
sanctify analyze ./wp-content/plugins/my-plugin/
# Auto-fix safe issues
sanctify fix ./src/
# Generate report
sanctify report ./theme/ > report.json
# Export infrastructure config
sanctify export --php-ini ./project/ >> php.ini
sanctify export --nginx ./project/ >> security.conf
sanctify export --guix ./project/ >> overrides.scm

Transformation Categories

Fully Automatic (Zero Risk)

• Add declare(strict_types=1)

• Add ABSPATH check for WordPress files

• Add missing text domains to i18n functions

• Wrap echo with esc_html() for variables

• Add exit; after wp_redirect()

• Convert rand() → random_int()

Semi-Automatic (Review Recommended)

• Wrap superglobals with sanitizers

• Replace $wpdb→query() with $wpdb→prepare()

• Infer return types from function body

• Add nonce verification to form handlers

Advisory Only

• SQL injection in complex queries

• Hardcoded secrets detection

• CSRF in AJAX handlers

• Capability escalation patterns

Container Integration

Sanctify-PHP integrates with the aegis container orchestrator to provide infrastructure-level hardening. See guix/wordpress-container.scm for an example hardened WordPress container.

# Generate container config based on analysis
sanctify export --guix ./project/ | aegis apply

Architecture

┌─────────────────────────────────────────────────────┐
│ sanctify-php │
├─────────────────────────────────────────────────────┤
│ Parser → AST → Analysis → Transform → Emit │
├──────────┬──────────┬──────────┬────────────────────┤
│ CLI │ LSP │ WP Plugin│ Library API │
│ (batch) │ (IDE) │ (scan) │ (integration) │
└──────────┴──────────┴──────────┴────────────────────┘

Modules

Module	Purpose
Sanctify.Parser	PHP parsing using Megaparsec
Sanctify.AST	Complete PHP AST representation
Sanctify.Analysis.Security	Security vulnerability detection
Sanctify.Analysis.Types	Type inference engine
Sanctify.Analysis.Taint	Taint tracking for data flow
Sanctify.WordPress.Constraints	WordPress-specific security rules
Sanctify.WordPress.Hooks	WordPress hook analysis
Sanctify.Transform.*	Code transformation passes
Sanctify.Emit	PHP code generation
Sanctify.Report	Multi-format report generation

License

PMPL-1.0-or-later

Related Projects

• aegis - Container orchestrator

• wordpress-wharf - WordPress deployment

• wp-audit-toolkit - WordPress auditing

Architecture

See TOPOLOGY.md for a visual architecture map and completion dashboard.