Taint-check in your browser

use Phan\Config;
use Phan\Issue;
use Phan\IssueInstance;
use Phan\Output\HTML;
use Phan\Output\IssuePrinterInterface;
use Symfony\Component\Console\Output\OutputInterface;

use Phan\CLI;
use Phan\Phan;
error_reporting(E_ALL);
ini_set('display_errors', 'stderr');
putenv('NO_COLOR=1');

try {
    $phar_path = 'phan-3.2.3.phar';
    if (!file_exists($phar_path)) {
        fwrite(STDERR, "Could not load '$phar_path' - this may not have been included when generating this site with emscripten\n");
        exit(1);
    }

$phar = "phar://$phar_path";
    gc_disable();
    $data = require($phar . '/src/Phan/Language/Internal/ClassDocumentationMap.php');
    require_once($phar . '/src/requirements.php');

$code_base = require_once($phar . '/src/codebase.php');

require_once($phar . '/src/Phan/Bootstrap.php');

$taintCheckPath = 'phan-taint-check-plugin-3.1.0';
// Bootstrap taint-check, since we can't really use composer autoloader. Note, order matters
// TODO This is not pretty.
require "$taintCheckPath/src/SecurityCheckPlugin.php";
require "$taintCheckPath/src/TaintednessBaseVisitor.php";
require "$taintCheckPath/src/TaintednessVisitor.php";
require "$taintCheckPath/src/TaintednessLoopVisitor.php";
require "$taintCheckPath/src/PreTaintednessVisitor.php";
require "$taintCheckPath/src/MWVisitor.php";
require "$taintCheckPath/src/MWPreVisitor.php";
require "$taintCheckPath/src/MediaWikiHooksHelper.php";
require "$taintCheckPath/src/Taintedness.php";
require "$taintCheckPath/src/FunctionTaintedness.php";

file_put_contents('input', $CONTENTS_TO_ANALYZE);
Config::setValue('file_list', ['input']);
// These plugins are what you'd see with --init-level=2
Config::setValue('plugins', [
    "./$taintCheckPath/GenericSecurityCheckPlugin.php"
]);
// This is stricter, though.
Config::setValue('plugin_config', [
    'infer_pure_methods' => true,
]);

// This is the list used by base-config.php in taint-check
Config::setValue( 'whitelist_issue_types', [
    'SecurityCheckMulti',
    'SecurityCheck-XSS',
    'SecurityCheck-SQLInjection',
    'SecurityCheck-ShellInjection',
    'SecurityCheck-DoubleEscaped',
    'SecurityCheck-CUSTOM1',
    'SecurityCheck-CUSTOM2',
    'SecurityCheck-OTHER',
    'SecurityCheck-LikelyFalsePositive',
    'PhanSyntaxError',
    'SecurityCheckDebugTaintedness',
] );

$cli = CLI::fromRawValues([
    'output-mode' => 'html',
    'allow-polyfill-parser' => false,
    'use-fallback-parser' => false,
    'redundant-condition-detection' => false,
    'dead-code-detection' => false,
    'no-progress-bar' => false,
], []);

// Analyze the file list provided via the CLI
$is_issue_found = Phan::analyzeFileList(
    $code_base,
    function (bool $recompute_file_list = false) use ($cli) : array {
        return $cli->getFileList();
    }
);
} catch (\Throwable $e) {
    echo "Caught $e\n";
}