SAST semgrep support for PHP 8 features
We are using Gitlab's SAST analysis (GitLab Enterprise Edition v17.4.2-ee) through standard CI configuration:
include:
- template: Jobs/SAST.latest.gitlab-ci.yml
sast: { stage: compliance-pipeline }
but it apparently chokes on many files with warnings like so
[WARN] [Semgrep] [2024-11-15T16:52:50Z] ▶ tool notification warning: Syntax error Syntax error at line src/Dto/EDCEmployeeAttributes.php:18:
`public` was unexpected
[WARN] [Semgrep] [2024-11-15T16:52:50Z] ▶ tool notification warning: Syntax error Syntax error at line src/Enum/DefaultPermissions.php:7:
`enum DefaultPermissions
{
public const COMPLIANCE_COCKPIT =` was unexpected
first example warning is a file where constructor promotion is used like so
class EDCEmployeeAttributes
{
/**
* @param list<string> $roles
* @param list<string> $tags
*/
public function __construct(
#[Assert\Email(groups: ['ACTIVE'])]
#[Assert\NotBlank(groups: ['ACTIVE'])]
public ?string $email = null,
) {}
}
second one is enums that came with PHP 8.1
I'm quite puzzled because from what I found your analyzer wraps semgrep, but when I run that analyzer, it works without any issues