Qodana, JetBrains' code quality platform, now provides support for PHP taint analysis in early preview. The feature aims to allow developers to detect taints in their programs, i.e. spots that are vulnerable to malicious inputs.
A taint is any variable that can be modified based on data provided by an external user. Depending on their context, taints could be exploited to cause SQL injection, arithmetic overflow, cross-site scripting, and other kinds of undesired effects.
The word taint hints at the property of a taint to make suspicious, that is convert into a taint, any other variable with which it has any relation. This means that taints form a chain or list that spreads potentially vulnerable locations throughout a program.
Taint analysis consists thus in analyzing the flow of untrusted user input to identify vulnerable locations with the objective of either sanitizing the data or validate it before using it or further propagating it through the system.
PHP taint analysis in Qodana can generate a dataflow graph to visualize the taint flow and is integrated with JetBrains PHP IDE PhpStorm to make it easier to jump to taint locations in your code. Qodana is able to display the taint flow both as a graph or by annotating your code.
On Twitter, JetBrains explained they will provide Qodana access for free to all open-source projects once it is out of early preview. While PHP is the first language for which Qodana is supporting taint analysis, JetBrains plans to extend this feature to other languages based on feedback received by PHP users. Most likely, JetBrains says, support for Java and Kotlin taint analysis will come next. An official roadmap is not available, yet, though.
Qodana for PHP can be tried out using an evaluation Docker image, through a GitHub action that can be used to scan a GitHub repo, or by integrating it directly into a CI pipeline.
If you are interested in taint analysis for PHP, you could find it interesting to know that there are a few open source static analysis tools that have provided it for a number of years, including PHPStan and Psalm.