Rule Definition
The software evaluates PHP code via user-controllable inputs. These inputs are not neutralized or are incorrectly neutralized. As a consequence, the PHP code may be completely altered.

Remediation
Prefer using a white list of permitted PHP codes, hard coded.

Violation Code Sample

function eval_queried_code(mysqli $mysql, string $query) : void {
    $result = mysqli_query($mysql, $query);
    if (mysqli_num_rows($result) > 0) {
        $row = mysqli_fetch_assoc($result);
        $code = $row["code"];
        eval($code);                                        // VIOLATION
    }
}

Fixed Code Sample

/**
* @psalm-taint-escape eval
*/
function my_escaping_function_for_evaluated_code(string input) : string {
    // Check that input is part of a hard-coded white-list of permitted PHP code
};

function eval_queried_code(mysqli $mysql, string $query) : void {
    $result = mysqli_query($mysql, $query);
    if (mysqli_num_rows($result) > 0) {
        $row = mysqli_fetch_assoc($result);
        $code = $row["code"];
        $code = my_escaping_function_for_evaluated_code($code);  // USE A FUNCTION ANNOTATED WITH @psalm-taint-escape eval
        eval($code);                                             // FIXED
    }
}

CWE-94: Improper Control of Generation of Code ('Code Injection') https://cwe.mitre.org/data/definitions/94.html CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') https://cwe.mitre.org/data/definitions/95.html Open Web Application Security Project (OWASP) https://www.owasp.org/index.php/Top_10-2017_A1-Injection OWASP Top Ten 2021 Category A03:2021 - Injection https://owasp.org/Top10/A03_2021-Injection/