PHPCodeSniffer

Auditor Job Name: PHP Security Audit v2 Auditor image: registry.gitlab.com/whitespots-public/security-images/phpcs-security-audit:2.0.1 AppSec Portal Importer Name: PHPCodeSniffer

Scanner tokenizes PHP files and detects violations of a defined set of coding standards.

PHPCodeSniffer is a set of two PHP scripts; the main phpcs script that tokenizes PHP, JavaScript and CSS files to detect violations of a defined coding standard, and a second phpcbf script to automatically correct coding standard violations. PHP_CodeSniffer is an essential development tool that ensures your code remains clean and consistent.

Curl example

curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./phpcs.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=PHPCodeSniffer" -F "branch=dev" -F "repository=[e-mail]:whitespots-public/appsec-portal.git"

In this command, the following parameters are used:

1. -X POST: specifies the HTTP method to be used (in this case, POST)

2. -H "Authorization: Token <authorization_token>": specifies the authorization token obtained from AppSec Portal.

3. -H "Content-Type: multipart/form-data": specifies the content type of the request.

4. -F "file=@<report_file_path>": specifies the path to the report file generated by the scanner.

5. -F "product_name=<product_name>": specifies the name of the product being scanned.

6. -F "product_type=<product_type>": specifies the type of the product being scanned.

7. -F "scanner_name=<scanner_name>": specifies the name of the scanner used to generate the report (PHPCodeSniffer)

8. -F "branch=<branch_name>": (optional) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch

Asset information, if an auditor is used

1. -F "repository=<repository SSH URL>": If your product is code in a repository enter the address of your repository in a specific format, for example: [e-mail]:whitespots-public/appsec-portal.git

2. -F "docker_image=<registry address>": If your product is image enter the address of the registry where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto_validator:latest

3. -F "domain=<domain>": If your product is web enter the domain name of your product, for example: whitespots.io

4. -F "host=<host>": If your product is web enter the IP address of your product, for example: 0.0.0.0

Report example:

$ phpcs /path/to/code/myfile.php

FILE: /path/to/code/myfile.php
--------------------------------------------------------------------------------
FOUND 5 ERROR(S) AFFECTING 2 LINE(S)
--------------------------------------------------------------------------------
  2 | ERROR | Missing file doc comment
 20 | ERROR | PHP keywords must be lowercase; expected "false" but found "FALSE"
 47 | ERROR | Line not indented correctly; expected 4 spaces but found 1
 51 | ERROR | Missing function doc comment
 88 | ERROR | Line not indented correctly; expected 9 spaces but found 6
--------------------------------------------------------------------------------