forked from FloeDesignTechnologies/phpcs-security-audit
-
Notifications
You must be signed in to change notification settings - Fork 0
/
example_drupal7_ruleset.xml
79 lines (71 loc) · 2.83 KB
/
example_drupal7_ruleset.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
<?xml version="1.0"?>
<ruleset name="Drupal7">
<description>Rules for Drupal 7 projects</description>
<!-- Code Reviews Rules -->
<!--
<rule ref="Generic.CodeAnalysis.UnusedFunctionParameter"/>
<rule ref="PEAR"/>
-->
<!-- Security Code Reviews Rules -->
<!-- Global properties -->
<!-- Please note that not every sniff uses them and they can be overwritten by rule -->
<!-- Framework or CMS used. Must be a class under Security_Sniffs. -->
<config name="CmsFramework" value="Drupal7"/>
<!-- Paranoya mode: Will generate more alerts but will miss less vulnerabilites. Good for assisting manual code review. -->
<config name="ParanoiaMode" value="1"/>
<!-- BadFunctions -->
<!-- PHP functions that can lead to security issues -->
<rule ref="Security.BadFunctions.Asserts"/>
<rule ref="Security.BadFunctions.Backticks"/>
<rule ref="Security.BadFunctions.CallbackFunctions"/>
<rule ref="Security.BadFunctions.CryptoFunctions"/>
<rule ref="Security.BadFunctions.EasyRFI"/>
<rule ref="Security.BadFunctions.EasyXSS"/>
<rule ref="Security.BadFunctions.ErrorHandling"/>
<rule ref="Security.BadFunctions.FilesystemFunctions"/>
<rule ref="Security.BadFunctions.FringeFunctions"/>
<rule ref="Security.BadFunctions.FunctionHandlingFunctions"/>
<rule ref="Security.BadFunctions.Mysqli"/>
<rule ref="Security.BadFunctions.NoEvals"/>
<rule ref="Security.BadFunctions.Phpinfos"/>
<rule ref="Security.BadFunctions.PregReplace"/>
<rule ref="Security.BadFunctions.SQLFunctions"/>
<rule ref="Security.BadFunctions.SystemExecFunctions"/>
<!-- CVE -->
<!-- Entries from CVE database from vendor PHP and bugs.php.net -->
<rule ref="Security.CVE.20132110"/>
<rule ref="Security.CVE.20134113"/>
<!-- Misc -->
<rule ref="Security.Misc.BadCorsHeader"/>
<rule ref="Security.Misc.IncludeMismatch"/>
<!-- Drupal7 -->
<!-- Specific security issues of Drupal7 and advisories -->
<rule ref="Security.Drupal7.AdvisoriesContrib">
<exclude-pattern>(?<!\.info)$</exclude-pattern>
</rule>
<rule ref="Security.Drupal7.AdvisoriesCore">
<exclude-pattern>(?<!includes\/bootstrap\.inc)$</exclude-pattern>
</rule>
<rule ref="Security.Drupal7.SQLi"/>
<rule ref="Security.Drupal7.SQLi.D7NoDbQuery"/>
<rule ref="Security.Drupal7.SQLi.D7DbQuerySQLi"/>
<rule ref="Security.Drupal7.SQLi.D7DbQueryDirectVar"/>
<rule ref="Security.Drupal7.XSSPTheme"/>
<rule ref="Security.Drupal7.UserInputWatch">
<properties>
<property name="FormThreshold" value="10"/>
<property name="FormStateThreshold" value="10"/>
</properties>
</rule>
<rule ref="Security.Drupal7.XSSFormValue"/>
<rule ref="Security.Drupal7.XSSHTMLConstruct"/>
<rule ref="Security.Drupal7.DbQueryAC">
<properties>
<!-- Comment out to follow global ParanoiaMode -->
<property name="forceParanoia" value="1"/>
</properties>
</rule>
<rule ref="Security.Drupal7.DynQueries"/>
<rule ref="Security.Drupal7.Cachei"/>
<rule ref="Security.Drupal7.HttpRequest"/>
</ruleset>