A PHP_CodeSniffer ruleset that detects security vulnerabilities and weaknesses in PHP code, including Drupal 7.
phpcs-security-audit is a security auditing tool for PHP code, implemented as a set of PHP_CodeSniffer rules. It scans PHP codebases to detect vulnerabilities, security weaknesses, and CVE-related issues, with specialized support for Drupal 7. The tool helps developers identify security flaws early in the development process, integrating into CI/CD pipelines for automated security checks.
PHP developers and security auditors working on PHP projects, especially those using Drupal 7, who need automated security scanning and vulnerability detection in their codebases.
Developers choose phpcs-security-audit for its deep integration with PHP_CodeSniffer, making it easy to incorporate into existing CI/CD workflows. Its focus on security-specific rules, adjustable paranoia mode, and framework customization capabilities provide tailored security scanning that balances thoroughness with practicality.
phpcs-security-audit is a set of PHP_CodeSniffer rules that finds vulnerabilities and weaknesses related to security in PHP code
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Identifies a wide range of vulnerabilities like XSS and remote code execution, with rules that check for direct user input, as shown in the tests.php output examples in the README.
Includes specific rules and utilities for Drupal 7, such as CVE advisory checking for modules from drupal.org, making it valuable for auditing legacy Drupal sites.
Paranoia mode allows customizing scan thoroughness, balancing false positives and security coverage, which is configurable via XML or CLI as detailed in the Customize section.
Built as PHP_CodeSniffer rules, it seamlessly integrates into continuous integration systems, with examples provided for Jenkins and command-line usage.
The README admits it can be slow on large codebases, with Drupal modules sometimes taking hours, and recommends workarounds like using --parallel or ignoring folders.
Prioritizes detection over accuracy, leading to many false positives that require paranoia mode tuning or manual review, which can be annoying in CI/CD environments.
The tool is 10 years old with some outdated parts, and Drupal support is only for version 7, not newer versions, limiting its relevance for modern projects.
Extending support for custom frameworks requires creating Utils.php and new sniffs, which is non-trivial and documented only for advanced users in the Specialize section.