Security Sniffs

With PHP CodeSniffer we have a good way to do testing for security vulnerabilities in code. I'm primarily concerned with XSS since it's the most popular vulnerability in Drupal code but SQL injection and others can be scanned for as well.

Here's a few ideas of what to search for:

• Tracing user input to output without sanitizing or filtering
• Finding callbacks that update the DB that are not access controlled
• Incorrect use of dbtng opening up sql injection

These checks will require a better API for following function calls, parameters and assignments. I think the work done in Drupal_Sniffs_Semantics_FunctionCall is the direction needed, extending Sniffs to easily traverse through the token stack to meet these goals.

For example, for the token drupal_get_title in Drupal 6 if the argument is a variable we'd need to traverse back to the assignment of that variable and add an error if it's assigned from user input, like $_GET or $node->title, so long as the stack doesn't contain that variable being filtered or sanitized.

Some questions to start:

1. What can be detected? Specific use cases are helpful as they can be turned into tests
2. In what ways could an API help with writing security sniffs? What are the common things that need to be done?