PHP Rewrite Update (v9.6.0)

This page showcases the different PHP language upgrade scenarios on version 9.6.0.

The query and the override will be available. It is advised to revalidate the custom query.

The override will be removed.

Related Links: SAST Resources and New and Changed Query Details (PDF)

The override will be available.

Related Links: SAST Resources and New and Changed Query Details (PDF)

Related Links: SAST Resources and New and Changed Query Details (PDF)

No problems are expected.

Related Links: SAST Resources and New and Changed Query Details (PDF)

Queries were modified with the focus of reducing false positives. As a side effect, the starting and ending nodes of the results in many queries now indicate the affected parameter versus the affected method when compared with the previous PHP version.

<?php
$foo = $_POST['foo'];
echo $foo;

// Before: $_POST (line2) -> echo (line 3)
// After: $_POST (line 2) -> $foo (line 3)

This kind of behavior is usual for most queries. For example, for generic database queries, the sink is the execution function parameter, not the method itself.

The following queries were renamed while reusing the same query ID. All the results are associated with the query ID and not with its name.

Notes:

Related Links: SAST Resources and New and Changed Query Details (PDF)

The results now reflect the language approach to case sensitivity, in this case, the lack of it.

<?php
// This behavior is valid for both user-defined functions and language built-ins
function sayHello(){
  echo 'Hello, World!';
}
// Old & New support finds this invocation
sayHello();
// Only New support finds this invocation
sayhello();

No problems are expected.

With the new PHP support version, in some cases, more DOM nodes will be available in the flow. If any flow is missing we highly recommend increasing the LazyFlow hops limit.

Before: The array was supported as MethodInvokeExpr, this means that any parameter will influence the return, giving origin to some FPs results.

After: The array map was fully supported as an AssociativeArray, which means that only the relevant flow for the specific key that is being used will appear.

<?php
$a = array("a" , "b");
echo $a[0]; // “a”

Before: All files were in a shared namespace, which meant they had by omission access to all other files.

After: We resolve the file inclusion using the given argument.

<?php 
// Supported
include __DIR__ . 'filename.php';
// Unsupported
include ABS_PATH . 'filename.php';

In our internal benchmarks, it was detected, to have a huge number of results revalidation after the upgrade. As already mentioned, most of the general queries were reviewed, which will have a big impact on the results.