Add security.xml for PHPCS Security

security.xml

@@ -0,0 +1,60 @@
+<?xml version="1.0"?>
+<ruleset xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="PHPSecurity" xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/squizlabs/PHP_CodeSniffer/master/phpcs.xsd">
+ <description>Rules for standard PHP projects</description>
+
+ <!-- Code Reviews Rules -->
+ <!--
+ <rule ref="Generic.CodeAnalysis.UnusedFunctionParameter"/>
+ <rule ref="PEAR"/>
+ -->
+
+ <!-- Security Code Reviews Rules -->
+
+ <!-- Global properties. -->
+ <!-- Please note that not every sniff uses them and they can be overwritten per rule. -->
+ <!-- Paranoia mode: Will generate more alerts but will miss less vulnerabilites. Good for assisting manual code review. -->
+ <config name="ParanoiaMode" value="1"/>
+
+ <arg name="extensions" value="php"/>
+
+ <!-- BadFunctions -->
+ <!-- PHP functions that can lead to security issues -->
+ <rule ref="Security.BadFunctions.Asserts"/>
+ <rule ref="Security.BadFunctions.Backticks"/>
+ <rule ref="Security.BadFunctions.CallbackFunctions"/>
+ <rule ref="Security.BadFunctions.CryptoFunctions"/>
+ <rule ref="Security.BadFunctions.EasyRFI"/>
+ <rule ref="Security.BadFunctions.EasyXSS">
+ <properties>
+ <!-- Comment out to follow global ParanoiaMode -->
+ <property name="forceParanoia" value="1"/>
+ </properties>
+ </rule>
+ <rule ref="Security.BadFunctions.ErrorHandling"/>
+ <rule ref="Security.BadFunctions.FilesystemFunctions"/>
+ <rule ref="Security.BadFunctions.FringeFunctions"/>
+ <rule ref="Security.BadFunctions.FunctionHandlingFunctions"/>
+ <rule ref="Security.BadFunctions.Mysqli"/>
+ <rule ref="Security.BadFunctions.NoEvals"/>
+ <rule ref="Security.BadFunctions.Phpinfos"/>
+ <rule ref="Security.BadFunctions.PregReplace"/>
+ <rule ref="Security.BadFunctions.SQLFunctions"/>
+ <rule ref="Security.BadFunctions.SystemExecFunctions"/>
+
+ <!-- CVE -->
+ <!-- Entries from CVE database from vendor PHP and bugs.php.net 
+ <rule ref="Security.CVE.CVE20132110"/>
+ <rule ref="Security.CVE.CVE20134113"/> -->
+
+ <!-- Misc -->
+ <rule ref="Security.Misc.BadCorsHeader"/>
+ <rule ref="Security.Misc.IncludeMismatch"/>
+ <!-- <rule ref="Security.Misc.TypeJuggle"/> -->
+
+
+ <file>.</file>
+ <report-file>joric.txt</report-file>
+ <exclude-pattern>*/vendor/*</exclude-pattern>
+ <exclude-pattern>*/node_modules/*</exclude-pattern>
+
+</ruleset>