php-security.yml

# SPDX-License-Identifier: PMPL-1.0-or-later
name: PHP Security Check

on: [push, pull_request]

permissions: read-all

jobs:
  security:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: PHP Security Scan
        run: |
          # Check for dangerous functions
          DANGEROUS=$(grep -rE 'eval\s*\(|exec\s*\(|system\s*\(|passthru\s*\(|shell_exec\s*\(|`.*\$' --include="*.php" . 2>/dev/null | grep -v 'vendor/' | head -10 || true)
          if [ -n "$DANGEROUS" ]; then
            echo "⚠️ Potentially dangerous PHP functions found:"
            echo "$DANGEROUS"
          fi
          
          # Check for SQL injection patterns
          SQLI=$(grep -rE '\$_(GET|POST|REQUEST).*query|mysqli_query.*\$_' --include="*.php" . 2>/dev/null | grep -v 'vendor/' | head -5 || true)
          if [ -n "$SQLI" ]; then
            echo "⚠️ Potential SQL injection patterns:"
            echo "$SQLI"
          fi
          
          # Check for XSS patterns
          XSS=$(grep -rE 'echo\s+\$_(GET|POST|REQUEST)' --include="*.php" . 2>/dev/null | grep -v 'vendor/' | head -5 || true)
          if [ -n "$XSS" ]; then
            echo "⚠️ Potential XSS patterns (unescaped output):"
            echo "$XSS"
          fi
          
          echo "✅ PHP security scan completed"