Qodana for PHP can be tried out using an evaluation Docker image, through a GitHub action that can be used to scan a GitHub repo, or by integrating it directly into a CI pipeline. An official roadmap is not available, yet, though. Most likely, JetBrains says, support for Java and Kotlin taint analysis will come next. While PHP is the first language for which Qodana is supporting taint analysis, JetBrains plans to extend this feature to other languages based on feedback received by PHP users. On Twitter, JetBrains explained they will provide Qodana access for free to all open-source projects once it is out of early preview. Qodana is able to display the taint flow both as a graph or by annotating your code. PHP taint analysis in Qodana can generate a dataflow graph to visualize the taint flow and is integrated with JetBrains PHP IDE PhpStorm to make it easier to jump to taint locations in your code. Taint analysis consists thus in analyzing the flow of untrusted user input to identify vulnerable locations with the objective of either sanitizing the data or validate it before using it or further propagating it through the system. This means that taints form a chain or list that spreads potentially vulnerable locations throughout a program. The word taint hints at the property of a taint to make suspicious, that is convert into a taint, any other variable with which it has any relation.

Depending on their context, taints could be exploited to cause SQL injection, arithmetic overflow, cross-site scripting, and other kinds of undesired effects.

spots that are vulnerable to malicious inputs.Ī taint is any variable that can be modified based on data provided by an external user. The feature aims to allow developers to detect taints in their programs, i.e. Qodana, JetBrains' code quality platform, now provides support for PHP taint analysis in early preview.

Gitlab phpstorm