From ac933ca59034623fc50a1a0f320897667ab742b2 Mon Sep 17 00:00:00 2001 From: jrfnl Date: Sun, 1 Nov 2026 02:09:49 +0100 Subject: [PATCH] SECURITY: clarify status of parse errors PHP_CodeSniffer is intended to scan valid PHP code. PHP_CodeSniffer attempts to be parse error tolerant, especially with an eye on its usage within IDE environments. Something which may be a parse error on one PHP version, may not be a parse error in another PHP version. PHP_CodeSniffer will handle those situations, generally caused by the introduction of new PHP syntaxes, in the Tokenizer layer. However, that's where the responsibility of PHP_CodeSniffer ends, as defending against every possible parse error a user can introduce is neigh impossible and scanning code containing parse errors is not a valid usecase for PHP_CodeSniffer. --- SECURITY.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 52e62e1..25db190 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,6 +12,9 @@ Running PHP_CodeSniffer against an untrusted or attacker-modifiable checkout mus CI environments processing untrusted contributions are responsible for appropriate isolation, including restricting access to credentials, secrets, privileged services, and sensitive network resources. +PHP_CodeSniffer is intended to scan valid PHP code. It is the responsibility of projects using PHP_CodeSniffer to validate code against parse errors before scanning such code with PHP_CodeSniffer. +Attack vectors which can only be triggered by an attacker introducing deliberate parse errors in otherwise valid code, do not classify as security vulnerabilities. They do qualify for security hardening and reports are appreciated. + ## Supported Versions For all repositories in the PHPCSStandards organisation, the latest patch version of the current major is supported for security updates.