Why GitHub new CodeQL security feature is not for PHP?

phpmagazine.net

5 points·hatemben··5 comments

Am I missing something? I didn't see a single mention of reasons why PHP was not supported in the current version of CodeQL.

I guess the question mark at the end of the title is there to show it’s a question and not an explaination.

It was too disapointed to not get an answer !

The new CodeQL feature supports only C, C++, C#, Java, JavaScript, TypeScript, Python, and Go developers. While PHP is classified as the 5th most active programming language on Github, it’s not supported by the new security code scanning feature. PHP developers have lots of alternatives depending on the framework you are using, or simply using static analysis tools such as Psalm and PHPStan.

>While PHP is classified as the 5th most active programming language on Github, it’s not supported by the new security code scanning feature.

Fyi constructive criticism... both your blog post and your HN comment do not directly answer the title's question of "Why not for PHP?"

The indirect answer seems to be: "because the CodeQL feature is based on the Semmle acquisition and that technology never analyzed PHP code -- and Microsoft/Github also didn't add PHP to this new rollout."

Also see comment from a Github employee: https://news.ycombinator.com/item?id=24648281

Interestingly enough I believe PHP would be the language where this would be most successful. I found around 30 vulnerabilities in PHP projects last year and most of them are of the form "dangerous function called on user-input".

Reply on news.ycombinator.com