Review PHP Patterns 6, 45, 47, 75, 83

PHP/45_static_method_from_variable/1_instance_45_static_method_from_variable/1_instance_45_static_method_from_variable.bash

@@ -1,42 +1,30 @@
-
-$_main: ; (lines=15, args=0, vars=2, tmps=8)
-    ; (before optimizer)
-    ; /home/user/gitlab/static-tools---latex/paper_code/PHP/Testability_Patterns/48_static_method_from_variable/48_static_method_from_variable.php:1-16
-L0 (3):     NOP
-L1 (14):    EXT_STMT
-L2 (14):    T2 = FETCH_R (global) string("_GET")
-L3 (14):    T3 = FETCH_DIM_R T2 string("p1")
-L4 (14):    ASSIGN CV0($b) T3
-L5 (15):    EXT_STMT
-L6 (15):    V5 = NEW 1 string("A")
-L7 (15):    SEND_VAR_EX CV0($b) 1
-L8 (15):    DO_FCALL
-L9 (15):    ASSIGN CV1($a) V5
-L10 (16):   EXT_STMT
-L11 (16):   V8 = FETCH_CLASS (exception) CV1($a)
-L12 (16):   INIT_STATIC_METHOD_CALL 0 V8 string("show_one")
-L13 (16):   DO_FCALL
-L14 (16):   RETURN int(1)
-LIVE RANGES:
-        5: L7 - L9 (new)
-
-A::__construct: ; (lines=7, args=1, vars=1, tmps=1)
-    ; (before optimizer)
-    ; /home/user/gitlab/static-tools---latex/paper_code/PHP/Testability_Patterns/48_static_method_from_variable/48_static_method_from_variable.php:5-7
-L0 (5):     EXT_NOP
-L1 (5):     CV0($b) = RECV 1
-L2 (6):     EXT_STMT
-L3 (6):     ASSIGN_OBJ THIS string("one")
-L4 (6):     OP_DATA CV0($b)
-L5 (7):     EXT_STMT
-L6 (7):     RETURN null
-
-A::show_one: ; (lines=6, args=0, vars=0, tmps=1)
-    ; (before optimizer)
-    ; /home/user/gitlab/static-tools---latex/paper_code/PHP/Testability_Patterns/48_static_method_from_variable/48_static_method_from_variable.php:9-11
-L0 (9):     EXT_NOP
-L1 (10):    EXT_STMT
-L2 (10):    T0 = FETCH_OBJ_R THIS string("one")
-L3 (10):    ECHO T0
-L4 (11):    EXT_STMT
-L5 (11):    RETURN null
+
+$_main:
+     ; (lines=13, args=0, vars=3, tmps=9)
+     ; (before optimizer)
+     ; /.../PHP/45_static_method_from_variable/1_instance_45_static_method_from_variable/1_instance_45_static_method_from_variable.php:1-12
+     ; return  [] RANGE[0..0]
+0000 T3 = FETCH_R (global) string("_GET")
+0001 T4 = FETCH_DIM_R T3 string("p1")
+0002 ASSIGN CV0($b) T4
+0003 V6 = NEW 0 string("A")
+0004 DO_FCALL
+0005 ASSIGN CV1($a) V6
+0006 V9 = FETCH_CLASS (exception) CV1($a)
+0007 INIT_STATIC_METHOD_CALL 1 V9 string("show_one")
+0008 SEND_VAR_EX CV0($b) 1
+0009 V10 = DO_FCALL
+0010 ASSIGN CV2($c) V10
+0011 ECHO CV2($c)
+0012 RETURN int(1)
+LIVE RANGES:
+     6: 0004 - 0005 (new)
+
+A::show_one:
+     ; (lines=3, args=1, vars=1, tmps=0)
+     ; (before optimizer)
+     ; /.../PHP/45_static_method_from_variable/1_instance_45_static_method_from_variable/1_instance_45_static_method_from_variable.php:3-5
+     ; return  [] RANGE[0..0]
+0000 CV0($a) = RECV 1
+0001 RETURN CV0($a)
+0002 RETURN null

PHP/45_static_method_from_variable/1_instance_45_static_method_from_variable/1_instance_45_static_method_from_variable.json

@@ -1,37 +1,38 @@
-{
-    "code": {
-        "path": "./1_instance_45_static_method_from_variable.php",
-        "injection_skeleton_broken": false
-    },
-    "discovery": {
-        "rule": "./1_instance_45_static_method_from_variable.sc",
-        "method": "joern",
-        "rule_accuracy": null,
-        "notes": null
-    },
-    "compile": {
-        "binary": "./1_instance_45_static_method_from_variable.bash",
-        "instruction": null,
-        "dependencies": null
-    },
-    "expectation": {
-        "type": "xss",
-        "sink_file": "./1_instance_45_static_method_from_variable.php",
-        "sink_line": 10,
-        "source_file": "./1_instance_45_static_method_from_variable.php",
-        "source_line": 14,
-        "expectation": true
-    },
-    "properties": {
-        "category": "D2",
-        "feature_vs_internal_api": "FEATURE",
-        "input_sanitizer": false,
-        "source_and_sink": false,
-        "negative_test_case": false
-    },
-    "remediation": {
-        "notes": "",
-        "transformation": null,
-        "modeling_rule": null
-    }
+{
+    "description": "This instance calls a static function on a variable. That variable contains an instance of a class.",
+    "code": {
+        "path": "./1_instance_45_static_method_from_variable.php",
+        "injection_skeleton_broken": false
+    },
+    "discovery": {
+        "rule": "./1_instance_45_static_method_from_variable.sc",
+        "method": "joern",
+        "rule_accuracy": "FP",
+        "notes": "The rule searches for `INIT_STATIC_METHOD_CALL` where the first argument is a variable."
+    },
+    "compile": {
+        "binary": "./1_instance_45_static_method_from_variable.bash",
+        "instruction": null,
+        "dependencies": null
+    },
+    "expectation": {
+        "type": "xss",
+        "sink_file": "./1_instance_45_static_method_from_variable.php",
+        "sink_line": 11,
+        "source_file": "./1_instance_45_static_method_from_variable.php",
+        "source_line": 8,
+        "expectation": true
+    },
+    "properties": {
+        "category": "D2",
+        "feature_vs_internal_api": "FEATURE",
+        "input_sanitizer": false,
+        "source_and_sink": false,
+        "negative_test_case": false
+    },
+    "remediation": {
+        "notes": "",
+        "transformation": null,
+        "modeling_rule": null
+    }
 }

PHP/45_static_method_from_variable/1_instance_45_static_method_from_variable/1_instance_45_static_method_from_variable.php

@@ -1,16 +1,11 @@
-<?php
-  class A {
-      public $one = 1;
-
-      function __construct($b){
-        $this->one = $b;
-      }
-
-      static function show_one() {
-          echo $this->one;
-      }
-  }
-
-$b = $_GET["p1"];
-$a = new A($b);
-$a::show_one();
+<?php
+class A {    
+    static function show_one($a) {
+      return $a;
+    }
+}
+
+$b = $_GET["p1"]; // source
+$a = new A();
+$c = $a::show_one($b);
+echo $c; // sink

PHP/45_static_method_from_variable/1_instance_45_static_method_from_variable/1_instance_45_static_method_from_variable.sc

@@ -1,6 +1,6 @@
-@main def main(name : String): Unit = {
-    importCpg(name)
-    val x45 = (name, "45_static_method_from_variable_iall", cpg.call.name(".*INIT_STATIC_METHOD_CALL.*").argument.order(1).code("CV.*|T.*|V.*").location.toJson);
-    println(x45)
-    delete;
+@main def main(name : String): Unit = {
+    importCpg(name)
+    val x45 = (name, "45_static_method_from_variable_iall", cpg.call.name(".*INIT_STATIC_METHOD_CALL.*").argument.order(1).code("CV.*|T.*|V.*").location.toJson);
+    println(x45)
+    delete;
 } 

PHP/45_static_method_from_variable/45_static_method_from_variable.json

@@ -1,14 +1,14 @@
-{
-    "name": "Static Method from Variable",
-    "description": "",
-    "family": "code_pattern_php",
-    "tags": [
-        "sast",
-        "php",
-        "php_v7.4.9"
-    ],
-    "instances": [
-        "./1_instance_45_static_method_from_variable/1_instance_45_static_method_from_variable.json"
-    ],
-    "version": "v0.draft"
+{
+    "name": "Static Method From Variable",
+    "description": "./docs/description.md",
+    "family": "code_pattern_php",
+    "tags": [
+        "sast",
+        "php",
+        "php_v7.4.9"
+    ],
+    "instances": [
+        "./1_instance_45_static_method_from_variable/1_instance_45_static_method_from_variable.json"
+    ],
+    "version": "v1.0"
 }