PHP Security Scanner - Production-Ready Static Analysis Tool

Advanced static analysis tool for PHP security vulnerabilities using taint analysis, AST parsing, and machine learning.

Features

Core Analysis

Taint Tracking: Intra-procedural dataflow analysis
Call Graph: Inter-procedural analysis infrastructure
7 Vulnerability Types: SQL injection, XSS, RCE, File inclusion, Command injection, Path traversal, Auth bypass
WordPress Support: WP-specific sanitizers, hooks, nonces, capabilities
Custom Rules: YAML-based DSL for organization-specific checks

Production Features

Multi-threaded Scanning: 12 workers (10x faster)
AST Caching: 80%+ hit rate, 20x speedup on incremental scans
Database Backend: SQLite/PostgreSQL with full history
REST API: FastAPI with background tasks
SARIF Export: GitHub Security, Azure DevOps compatible
Suppression System: Fingerprint + pattern-based false positive management
Plugin System: Extensible hooks for custom analysis

Enterprise

Docker Deployment: Multi-service orchestration
CI/CD Integration: GitHub Actions, GitLab CI
Batch Scanning: Multi-project analysis with consolidated reports
Web Interface: Interactive dashboard for scan management
Monitoring: Prometheus metrics, Slack notifications
Policy Enforcement: Configurable thresholds with build failure

Quick Start

# Setup
python3 -m venv .venv
source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install -r requirements.txt
# Initialize database
python cli.py --init-db
# Scan a project
python cli.py scan --dir /path/to/php/project --project myapp
# With plugins enabled
python cli.py scan --dir /path/to/php/project --enable-plugins
# Export to SARIF
python cli.py export --scan-id 1 --format sarif --output results.sarif
# Web interface
python web_interface.py
# Open http://localhost:5000

Architecture

Entry Points: CLI, Web Interface, REST API

cli.py - Command-line interface
web_app.py - Interactive web dashboard
api/main.py - FastAPI REST endpoints

Core Scanner (workers/parallel_scanner.py)

Multi-threaded scanning (12 workers default)
Plugin hook system for extensibility
Real-time progress tracking

Analysis Engine

Taint Tracker: Intra-procedural dataflow analysis
Call Graph: Inter-procedural analysis infrastructure
Interprocedural: Function parameter/return tracking

Caching Layer

AST Cache: Disk-based with 80%+ hit rates
Redis L2: Optional distributed caching
20x speedup on incremental scans

Plugin System

WordPress: Framework-specific analysis
Performance Monitor: Scan optimization
Slack: Team notifications
Security Policies: CI/CD enforcement

Storage & Export

Database: SQLite/PostgreSQL with scan history
Suppressions: YAML-based with audit trail
Export: SARIF, JSON, HTML, Prometheus metrics

Usage

CLI Commands

# Scan commands
python cli.py scan --dir /path/to/project
python cli.py scan --files file1.php file2.php
python cli.py scan --dir /path --vuln-types sql_injection xss rce
# Export commands
python cli.py export --scan-id 1 --format sarif --output report.sarif
python cli.py export --scan-id 1 --format json --output report.json
python cli.py export --scan-id 1 --format html --output report.html
# Suppression management
python cli.py suppress add --file app.php --line 42 --type xss --reason "False positive"
python cli.py suppress list
python cli.py suppress remove --id 5
# Statistics
python cli.py stats --project myapp
python cli.py stats --scan-id 10
# Cache management
python cli.py cache clear
python cli.py cache stats
# Project management
python cli.py projects list
python cli.py projects info --name myapp

REST API

# Start API server
uvicorn api.main:app --reload
# Endpoints
GET / # API info
GET /projects # List projects
POST /scan # Trigger scan
GET /scans/{id} # Scan status
GET /vulnerabilities/{scan_id} # List vulnerabilities
GET /export/{scan_id}/sarif # Export SARIF
POST /suppressions/add # Add suppression

Web Interface

# Start web server
python web_interface.py
# Features:# - Project selection# - Real-time scan progress# - Vulnerability dashboard# - Interactive filtering# - SARIF export# - Suppression management

Python API

fromworkers.parallel_scannerimportParallelScannerfrompluginsimportPluginManager, WordPressPlugin# Initializemanager=PluginManager()
manager.register(WordPressPlugin())
scanner=ParallelScanner(
vuln_types=['sql_injection', 'xss', 'rce'],
max_workers=12,
use_cache=True,
plugin_manager=manager
)
# Scanscan_context= {'root_path': '/path/to/project', 'project': 'myapp'}
# noinspection PyUnresolvedReferencesresults=scanner.scan_files(php_files, scan_context=scan_context)
# Get statisticsstats=scanner.get_statistics(results)
print(f"Found {stats['total_vulnerabilities']} vulnerabilities")

Plugin System

Built-in Plugins

WordPress: Detects WP projects, tracks hooks/actions
Performance: Monitors scan time, identifies slow files
Metrics Exporter: Prometheus/JSON metrics
Slack Notifier: Rich notifications with severity colors
Security Policy: CI/CD policy enforcement with thresholds

Creating Custom Plugins

frompluginsimportScannerPluginclassMyPlugin(ScannerPlugin):
defon_scan_start(self, context):
print(f"Scanning {context['project']}")
defon_file_scanned(self, file_path, results):
# Process file resultspassdefon_scan_complete(self, scan_results):
print(f"Found {len(scan_results['vulnerabilities'])} issues")
defon_vulnerability_found(self, vulnerability):
# Modify or filter vulnerabilitiesreturnvulnerability

See docs/PLUGINS.md for detailed documentation.

Batch Scanning

Scan multiple projects with consolidated reports:

python scripts/batch_scan.py /path/to/projects --output batch_results/
# Generates:# - JSON summary per project# - SARIF per project# - Consolidated HTML report

Performance

Files	Workers	Cache	Time	Throughput
100	1	No	30s	3 f/s
100	12	No	3s	33 f/s
100	12	Yes	1s	100 f/s
1,000	12	No	5m	3.3 f/s
1,000	12	Yes	5s	200 f/s

Run benchmarks: python benchmarks/benchmark_performance.py

Docker Deployment

# Start all services
docker-compose up -d
# Services:# - API (port 8000)# - PostgreSQL (port 5432)# - Redis (port 6379)# - Worker (background)# Scan via API
curl -X POST http://localhost:8000/scan \
-H "Content-Type: application/json" \
-d '{"project": "myapp", "path": "/app/src"}'

CI/CD Integration

GitHub Actions

- name: Security Scanrun: | python cli.py scan --dir . --project ${{ github.repository }} python cli.py export --scan-id latest --format sarif --output results.sarif- name: Upload SARIFuses: github/codeql-action/upload-sarif@v2with:
sarif_file: results.sarif

Policy Enforcement

# In your CI pipelinefromplugins.security_policyimportSecurityPolicyPluginplugin=SecurityPolicyPlugin(
max_critical=0, # No critical allowedmax_high=5, # Max 5 high severitymax_total=50, # Max 50 totalfail_on_violation=True# Exit 1 on violation
)
# Exits with code 1 if thresholds exceeded

Configuration

Rules (config/rules.yaml)

- name: custom_sql_injectionsources:
- pattern: "$_GET[*]"sinks:
- node_type: function_call_expressionfunction: custom_queryvuln: sql_injectionfilters:
- function: escape_sqlsanitizes: [ sql_injection ]

Suppressions (suppressions.yaml)

suppressions:
- fingerprint: "abc123..."reason: "False positive - input validated upstream"author: "security-team"added_at: "2025-01-12T10:00:00Z"patterns:
- file_pattern: "vendor/.*"type: "*"reason: "Third-party code"

Testing

# Run all tests (118 tests total)
pytest -v # 97 pytest tests
behave features/ --tags=-skip # 21 BDD scenarios# Specific test suites
pytest tests/test_taint_tracker.py -v # 35 tests
pytest tests/test_plugins.py -v # 12 tests
pytest integration_tests/ -v # 7 tests# With coverage
pytest --cov=. --cov-report=html

Algorithm

The scanner uses taint analysis:

Sources: Identify untrusted input ($_GET, $_POST, etc.)
Propagation: Track data flow through variables, functions
Sinks: Detect dangerous functions (mysqli_query, echo, eval)
Sanitizers: Recognize security filters (htmlspecialchars, etc.)
Report: Flag tainted data reaching sinks without sanitization

Example

// Source: tainted input$id = $_GET['id'];
// Propagation: taint flows to $query$query = "SELECT * FROM users WHERE id = " . $id;
// Sink: dangerous function with tainted datamysqli_query($conn, $query); // ⚠️ SQL INJECTION detected// Safe version:$id = intval($_GET['id']); // Sanitizer$query = "SELECT * FROM users WHERE id = " . $id;
mysqli_query($conn, $query); // ✓ No vulnerability

Documentation

ARCHITECTURE.md - System architecture
PLUGINS.md - Plugin development guide
API.md - REST API documentation

Roadmap

Phase 3: Advanced Analysis

Symbolic execution
Abstract interpretation
Alias analysis
Object sensitivity

Phase 4: Intelligence

ML-based prioritization
Historical trend analysis
Auto-fix suggestions
IDE integration (LSP)

Phase 5: Enterprise

Multi-tenant support
RBAC
SSO integration
Compliance reports (PCI-DSS, OWASP)

Contributing

Fork the repository
Create feature branch (git checkout -b feature/amazing)
Commit changes (git commit -m 'feat: Add amazing feature')
Push to branch (git push origin feature/amazing)
Open Pull Request

License

MIT License - see LICENSE file

Credits

Built with:

tree-sitter - AST parsing
FastAPI - REST API
SQLAlchemy - Database ORM
diskcache - Persistent caching

Version 2.4.0 | 118 tests passing (97 pytest + 21 BDD) | Production-ready

Name		Name	Last commit message	Last commit date
.claude		.claude
.github/workflows		.github/workflows
analysis		analysis
api		api
benchmarks		benchmarks
cache		cache
config		config
core		core
db		db
docs		docs
examples		examples
exporters		exporters
features		features
integration_tests		integration_tests
optimization		optimization
parser		parser
plugins		plugins
report		report
scripts		scripts
suppressions		suppressions
tests		tests
utils		utils
workers		workers
.dockerignore		.dockerignore
.env.example		.env.example
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
Dockerfile		Dockerfile
Makefile		Makefile
QUICKSTART.md		QUICKSTART.md
README.md		README.md
VERSION		VERSION
alembic.ini		alembic.ini
cli.py		cli.py
config.yaml.example		config.yaml.example
docker-compose.yml		docker-compose.yml
requirements-dev.txt		requirements-dev.txt
requirements.txt		requirements.txt
scanner.db-shm		scanner.db-shm
scanner.db-wal		scanner.db-wal
scanner.py		scanner.py
web_interface.py		web_interface.py

Uh oh!

Latest commit

History

Folders and files

Repository files navigation