sync: Monthly version update

.gitignore

@@ -15,6 +15,7 @@ test/javascript/benchmarks
 test/go/benchmarks
 test/python/benchmarks
 test/java/benchmarks
+test/php/benchmarks
 CNVD-*/
 TODO.md
 *.dot
@@ -50,4 +51,10 @@ src/uast
 deps-runtime/
 .cursorrules
 test/javascript/test-report
+test/trace-accuracy-reports
+test/java/report
+test/python/report
+test/javascript/report
+test/php/report
 deps
+node_modules

.npmrc

@@ -0,0 +1 @@
+registry=https://registry.npmmirror.com

build.sh

@@ -41,6 +41,13 @@ if ! npm install --package-lock=false > /dev/null; then
 fi
 success "依赖安装完成"
 
+# 步骤 1.5: patch @ant-yasa/uast-parser-php 规避 pkg 对 require.resolve('*.wasm') 的 UTF-8 mangle
+info "步骤 1.5/8: patch uast-parser-php (node scripts/patch-uast-parser-php.js)"
+if ! node scripts/patch-uast-parser-php.js; then
+    alert "uast-parser-php patch 失败"
+fi
+success "uast-parser-php patch 完成"
+
 # 步骤 2: 类型检查
 info "步骤 2/8: 类型检查 (npx tsc --noEmit)"
 # 只重定向 stdout，保留 stderr 以便显示错误信息
@@ -110,7 +117,7 @@ EOF
 info "步骤 7/8: 打包二进制 (npx pkg)"
 # 只重定向 stdout，保留 stderr 以便显示错误信息
 set +e
-npx pkg . --options max-old-space-size=12288 > /dev/null
+npx pkg . --options max-old-space-size=11264 > /dev/null
 PKG_EXIT_CODE=$?
 set -e
 if [ $PKG_EXIT_CODE -ne 0 ]; then

package.json

@@ -5,8 +5,9 @@
   "main": "./dist/main.js",
   "bin": "./dist/main.js",
   "dependencies": {
-    "@ant-yasa/uast-parser-java-js": "^0.2.9",
-    "@ant-yasa/uast-spec": "^0.2.9",
+    "@ant-yasa/uast-parser-java-js": "^0.2.13",
+    "@ant-yasa/uast-parser-php": "^0.2.13",
+    "@ant-yasa/uast-spec": "^0.2.13",
     "@babel/core": "^7.14.6",
     "@babel/parser": "^7.16.4",
     "@babel/plugin-proposal-decorators": "^7.14.5",
@@ -89,11 +90,17 @@
     "test-python": "npx mocha --require tsx/cjs test/python/test-python-benchmark.ts",
     "test-callchain": "npx mocha --require tsx/cjs test/callchain/test-callchain-benchmark.ts",
     "test-callargs": "npx mocha --require tsx/cjs test/callargs/test-callargs.ts",
-    "test-all": "npm run test-callargs && npm run test-js && npm run test-java && npm run test-go && npm run test-python && npm run test-callchain",
+    "test-match-field": "npx mocha --require tsx/cjs test/rules-basic-handler/test-match-field.ts",
+    "test-sink-util-new-expr": "npx mocha --require tsx/cjs test/rules-basic-handler/test-sink-util-new-expr.ts",
+    "test-php-checker": "npx mocha --require tsx/cjs test/php/test-php-checker.ts",
+    "test-php": "npx mocha --require tsx/cjs test/php/test-php-benchmark.ts",
+    "test-all": "npm run test-callargs && npm run test-match-field && npm run test-sink-util-new-expr && npm run test-js && npm run test-java && npm run test-go && npm run test-python && npm run test-callchain && npm run test-php",
     "build": "bash build.sh",
     "lint": "eslint .",
     "lint:duplicates": "jscpd .",
-    "lint:fix": "eslint --fix ."
+    "lint:fix": "eslint --fix .",
+    "trace-accuracy": "npx tsx test/trace-accuracy.ts",
+    "trace-accuracy-all": "NODE_OPTIONS='--max-old-space-size=13312' npx tsx test/trace-accuracy-all.ts"
   },
   "install": "npm install",
   "files": [
@@ -173,7 +180,9 @@
       "dist/**/*",
       "resource/**/*",
       "deps/uast4go/uast4go",
-      "deps/uast4py/uast4py"
+      "deps/uast4py/uast4py",
+      "node_modules/tree-sitter-php/*.wasm",
+      "node_modules/web-tree-sitter/web-tree-sitter.wasm"
     ],
     "targets": [
       "node18-macos-arm64",

resource/checker/checker-config.json

@@ -140,11 +140,22 @@
     "checkerPath": "checker/taint/python/tornado-taint-checker.ts",
     "description": "python Tornado框架 entrypoint采集以及框架source添加"
   },
+  {
+    "checkerId": "taint_flow_python_httpserver_input",
+    "checkerPath": "checker/taint/python/httpserver-taint-checker.ts",
+    "description": "python http.server框架 entrypoint采集以及框架source添加"
+  },
   {
     "checkerId": "taint_flow_python_script_input",
     "checkerPath": "checker/taint/python/script-taint-checker.ts",
     "description": "Python脚本命令行参数source添加，支持argparse/sys.argv/input/os.environ/getopt等"
   },
+  {
+    "checkerId": "taint_flow_php_input",
+    "checkerPath": "checker/taint/php/php-default-taint-checker.ts",
+    "description": "PHP污点分析checker，会使用CallGraph边界制作entrypoint",
+    "demoRuleConfigPath": "resource/example-rule-config/rule_config_php.json"
+  },
   {
     "checkerId": "taint_flow_test",
     "checkerPath": "checker/taint/test-taint-checker.ts",
@@ -194,5 +205,11 @@
     "checkerPath": "checker/callchain/python/python-callchain-checker.ts",
     "description": "Python callchain checker，只检测sink匹配并输出调用链路",
     "demoRuleConfigPath": "resource/example-rule-config/rule_config_python.json"
+  },
+  {
+    "checkerId": "callchain_php",
+    "checkerPath": "checker/callchain/php/php-callchain-checker.ts",
+    "description": "PHP callchain checker，只检测sink匹配并输出调用链路",
+    "demoRuleConfigPath": "resource/example-rule-config/rule_config_php.json"
   }
 ]

resource/checker/checker-pack-config.json

@@ -88,6 +88,7 @@
       "taint_flow_python_input",
       "taint_flow_python_django_input",
       "taint_flow_python_tornado_input",
+      "taint_flow_python_httpserver_input",
       "callgraph",
       "sanitizer"
     ],
@@ -99,6 +100,7 @@
       "taint_flow_python_input_inner",
       "taint_flow_python_django_input",
       "taint_flow_python_tornado_input",
+      "taint_flow_python_httpserver_input",
       "callgraph",
       "sanitizer"
     ],
@@ -153,5 +155,21 @@
       "callchain_python"
     ],
     "description": "Python callchain checker - 只检测sink匹配"
+  },
+  {
+    "checkerPackId": "taint-flow-php-default",
+    "checkerIds": [
+      "taint_flow_php_input",
+      "callgraph",
+      "sanitizer"
+    ],
+    "description": "PHP污点追踪-对外默认使用的规则包"
+  },
+  {
+    "checkerPackId": "callchain-php",
+    "checkerIds": [
+      "callchain_php"
+    ],
+    "description": "PHP callchain checker - 只检测sink匹配"
   }
 ]