Skip to content

SAST semgrep support for PHP 8 features

We are using Gitlab's SAST analysis (GitLab Enterprise Edition v17.4.2-ee) through standard CI configuration:

include:
  - template: Jobs/SAST.latest.gitlab-ci.yml
sast: { stage: compliance-pipeline }

but it apparently chokes on many files with warnings like so

[WARN] [Semgrep] [2024-11-15T16:52:50Z] ▶ tool notification warning: Syntax error Syntax error at line src/Dto/EDCEmployeeAttributes.php:18:
 `public` was unexpected
[WARN] [Semgrep] [2024-11-15T16:52:50Z] ▶ tool notification warning: Syntax error Syntax error at line src/Enum/DefaultPermissions.php:7:
 `enum DefaultPermissions
{
    public const COMPLIANCE_COCKPIT =` was unexpected

first example warning is a file where constructor promotion is used like so

class EDCEmployeeAttributes
{
    /**
     * @param list<string> $roles
     * @param list<string> $tags
     */
    public function __construct(
        #[Assert\Email(groups: ['ACTIVE'])]
        #[Assert\NotBlank(groups: ['ACTIVE'])]
        public ?string $email = null,
    ) {}
}

second one is enums that came with PHP 8.1

I'm quite puzzled because from what I found your analyzer wraps semgrep, but when I run that analyzer, it works without any issues