Migrate phpcs-security-audit coverage to Semgrep-based analyzer

The phpcs-security-audit analyzer should have its coverage converted to Semgrep.

Semgrep's PHP support is now GA as of this 2022-06-21 and there are some rules ported from phpcs-security-audit.

@idawson notes that recent Semgrep improvements should help with this conversion.

The phpcs-security-audit analyzer has also suffered a lack of maintenance since about March 2020, per #361157 (closed).d

Implementation Plan

• Copy rules from https://semgrep.dev/p/phpcs-security-audit to https://gitlab.com/gitlab-org/security-products/sast-rules

  • Find out how to adhere to the LGPL common clause license (#364060 (comment 1711983460)) Resolve this before moving forward.
  • Ensure rules are in the LGPL directory
  • Ensure each rule has the correct LGPL-CC license header example header
  • Ensure each rule is tested by adding a test file of the format rule-(RULE_NAME).langext. If a test is not added the build will fail.

  Migrate phpcs-security-audit coverage to Semgre... (gitlab-org/security-products/sast-rules!341 - merged) • Adam Cohen • 16.9

• Map and create Primary Identifiers. (The way I've identified primary IDs before is to run the original scanner, in this case PHPCS on a fixture and find the identification tag in the generated report example)

  Migrate phpcs-security-audit coverage to Semgre... (gitlab-org/security-products/sast-rules!341 - merged) • Adam Cohen • 16.9

• Add to semgrep

  • Add rules to semgrep by copying them over in the Dockerfile
  • Add integration spec
    • Add a with PHP context
    • add expected JSON which can be generated using analyzer-refresh-expected-json

  Enable support for php (gitlab-org/security-products/analyzers/semgrep!367 - merged) • Adam Cohen • 16.9

• Update semgrep-sast job of SAST.gitlab-ci.yml template to include rule for '**/*.php'

  Add php support for semgrep (!143472 - merged) • Adam Cohen • 16.10

Rules Migrated from phpcs-security-audit to semgrep

As discussed here, we only added 9 rules to GitLab semgrep, however, there are 16 rules in GitLab phpcs-security-audit:

Number	Migrated?	GitLab phpcs-security-audit rule	GitLab semgrep rule	Notes
1	✅	Security.BadFunctions.Asserts	php_assert_rule-assert-use
2	✅	Security.BadFunctions.Backticks	php_backticks_rule-backticks-use
3	✅	Security.BadFunctions.CryptoFunctions	php_crypto_rule-weak-crypto php_mcrypt_rule-mcrypt-use
4	✅	Security.BadFunctions.FilesystemFunctions	php_file_rule-file-inclusion
5	✅	Security.BadFunctions.NoEvals	php_eval_rule-eval-use
6	✅	Security.BadFunctions.Phpinfos	php_phpinfo_rule-phpinfo-use
7	✅	Security.BadFunctions.SystemExecFunctions	php_exec_rule-exec-use
8	✅	Security.BadFunctions.FringeFunctions	php_ftp_rule-ftp-use
9	❌	Security.BadFunctions.CallbackFunctions
10	❌	Security.BadFunctions.EasyRFI
11	❌	Security.BadFunctions.EasyXSS
12	❌	Security.BadFunctions.ErrorHandling
13	❌	Security.BadFunctions.FunctionHandlingFunctions
14	❌	Security.BadFunctions.Mysqli
15	❌	Security.BadFunctions.PregReplace		Rule is no longer applicable
16	❌	Security.BadFunctions.SQLFunctions

We plan on adding more rules as part of https://gitlab.com/gitlab-org/gitlab/-/issues/457901+s.