Fedora 44 : php-pear-PHP-CodeSniffer (2026-d536e7004b)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2026-d536e7004b
#

include('compat.inc');

if (description)
{
  script_id(335494);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/15");
  script_xref(name:"FEDORA", value:"2026-d536e7004b");

  script_name(english:"Fedora 44 : php-pear-PHP-CodeSniffer (2026-d536e7004b)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the
FEDORA-2026-d536e7004b advisory.

    ## Version 4.0.4 - 2026-08-06

    **This is a security release and all users are advised to update their install(s) as soon as possible.**
    The security issue only affects users of the `Gitblame`, `Hgblame` or `Svnblame` report(s).

    ### Added

    - Tokenizer support for the PHP 8.5 `(void)` cast. [#1325]
        The `T_VOID_CAST` token has been added to the `Tokens::CAST_TOKENS` array.
    - `suggest` section to the `composer.json` file to inform users about the recommended `iconv` and `pcntl`
    PHP extensions. [#1388]
        - Thanks to [Rodrigo Primo][@rodrigoprimo] for the patch.

    ### Changed

    - Clarified that `libxml` is a required PHP extension. [#1409]
    - Squiz.Scope.StaticThisUsage: the sniff will now also search for the use of `$this` in static closures.
    [#1377]
    - The Generic.PHP.LowerCaseKeyword, Generic.WhiteSpace.LanguageConstructSpacing and
    Squiz.Functions.FunctionDeclarationArgumentSpacing sniffs no longer embed UTF-8 middot characters for
    spaces in error messages. [#1379], [#1389] Fixes [Squiz/#2652][sq-2652].
        - Thanks to [Rodrigo Primo][@rodrigoprimo] for the patches.
    - PSR2.ControlStructures.SwitchDeclaration: the error message for the use of colon + curly braces
    (`WrongOpener*`) has been made more informative. [#1358]. Fixes [#1322].
        - Thanks to [Sule-Balogun Olanrewaju][@bigdevlarry] for the patch.
    - The error messages for the following sniffs have been improved by exposing more data placeholders:
        - `PEAR.Functions.FunctionDeclaration` [#1445]
            - The `CloseBracketLine` error message now exposes 1 data value (previously 0).
            - The `EmptyLine` error message now exposes 1 data value (previously 0).
            - The `Indent` error message now exposes 3 data values (previously 2).
            - These changes also affect the same error codes for the `PSR12.Classes.AnonClassDeclaration` and
    `Squiz.Functions.MultiLineFunctionDeclaration` sniffs.
        - `PSR2.Classes.ClassDeclaration` [#1446]
            - The `ExtendsLine` and `ImplementsLine` error messages now expose 3 data values (previously 1).
            - The `SpaceBeforeExtends` and `SpaceBeforeImplements` error messages now expose 2 data values
    (previously 1).
            - These changes also affect the same error codes for the `PSR12.Classes.AnonClassDeclaration` and
    `Squiz.Classes.ClassDeclaration` sniffs.
        - `PSR2.ControlStructures.SwitchDeclaration` [#1447]
            - The `defaultNotLower` and `caseNotLower` error messages now expose 3 data values (previously 2).
            - The `SpaceBeforeColonDEFAULT` and `SpaceBeforeColonCASE` error messages now expose 1 data value
    (previously 0).
            - The `BodyOnNextLineDEFAULT` and `BodyOnNextLineCASE` error messages now expose 1 data value
    (previously 0).
            - The `WrongOpenerdefault` and `WrongOpenercase` error messages now expose 1 data value
    (previously 0).
        - `Squiz.ControlStructures.SwitchDeclaration` [#1449]
            - The `CaseNotLower` and `DefaultNotLower` error messages now expose 3 data values (previously 2).
            - The `CaseIndent` and `DefaultIndent` error messages now expose 2 data values (previously 0).
            - The `SpaceBeforeColonCase` and `SpaceBeforeColonDefault` error messages now expose 1 data value
    (previously 0).
            - The `BreakIndent` error message now exposes 1 data value (previously 0).
            - The `SpacingAfterCase` and `SpacingAfterDefault` error messages now expose 1 data value
    (previously 0).
        - `Squiz.Functions.FunctionDeclarationArgumentSpacing` [#1452]
            - The `SpaceBeforeEquals` error message now exposes 3 data values (previously 2).
            - The `SpaceAfterEquals` error message now exposes 3 data values (previously 2).
        - `Squiz.Functions.MultiLineFunctionDeclaration` [#1453]
            - The `FirstParamSpacing` and `UseFirstParamSpacing` error messages now expose 1 data value
    (previously 0).
            - The `OneParamPerLine` and `UseOneParamPerLine` error messages now expose 1 data value
    (previously 0).
            - These changes also affect the same error codes for the `PSR12.Classes.AnonClassDeclaration`
    sniff.
        - If you have customised the error messages of these sniffs, please review your ruleset after
    upgrading.
        - Thanks to [Zhang WenTao][@ntdiary] for these patches.
    - The following sniff(s) have received efficiency improvements:
        - PSR2.Classes.PropertyDeclaration
        - Thanks to [Jonathan Champ][@jrchamp] for the patch.
    - The test suite is now more contributor friendly for contributors on MacOS. [#1437]
        - Thanks to [Sergei Morozov][@morozov] for the patch.
    - Various housekeeping, including improvements to the tests and documentation.
        - Thanks to [Dan Wallis][@fredden], [Rodrigo Primo][@rodrigoprimo], [Sergei Morozov][@morozov] and
    [Juliette Reinders Folmer][@jrfnl] for their contributions.

    ### Fixed

    - **SECURITY FIX**: Running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans
    pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled
    shell commands being executed when the `Gitblame`, `Hgblame` or `Svnblame` report(s) would process a file
    whose name contains shell metacharacters. [#1473]
        - Users using the default `Full` report, or any of the other non-*blame reports, are not affected.
        - For more details, see the [security advisory][sec-1].
        - Thanks go to [Faze-up][@Faze-up] and [Volker Dusch][@edorian] for responsibly disclosing the
    vulnerability.
        - Additionally, thanks go to [Volker Dusch][@edorian], [Rodrigo Primo][@rodrigoprimo], [Dan
    Wallis][@fredden] and [Juliette Reinders Folmer][@jrfnl] for creating and testing the fix.
    - Fixed bug [#1320]: Generic.Strings.UnnecessaryHeredoc: the fixer could incidentally change tab
    indentation to space indentation in select lines in the heredoc body.
    - Fixed bug [#1354]: PSR12.Functions.ReturnTypeDeclaration: prevent an Undefined array key warning if
    the code under scan contains a parse error.
        - Thanks to [Dan Wallis][@fredden] for the patch.
    - Fixed bug [#1357]: Squiz.Scope.StaticThisUsage: false positive for usage of `$this` in non-static
    closures nested in OO methods.
    - Fixed bug [#1368]: PEAR.Functions.FunctionDeclaration: the indentation for subsequent lines in multi-
    line block comments within a multi-line function signature, would be incorrectly determined, leading to
    false positives and resulting in a fixer conflict when running `phpcbf`.
        - This also fixes, by extension, the same issue in the `Squiz.Functions.MultiLineFunctionDeclaration`
    sniff.
    - Fixed bug [#1418]: Tokenizer/PHP: tokenization of an inline else colon after an inline comment could
    fail and/or throw a Trying to access array offset on null warning.
        - Thanks to [Lazizbek Ergashev][@lazerg] for the patch.
    - Fixed bug [#1435]: Generic.Formatting.MultipleStatementAlignment would get into a fixer conflict for
    multiple assignments within a single statement spanning multiple lines.
        - Same as when the statement would be single-line, alignment of subsequent assignment operators within
    the same multi-line statement will now be ignored.
        - Thanks to [Sergei Morozov][@morozov] for the patch.
    - Fixed bug [#1451]: Tokenizer/PHP: prevent an Undefined array key warning during live coding when a
    file ends on the name in a constant declaration.
        - Thanks to [Lazizbek Ergashev][@lazerg] and [Sai Asish Y][@SAY-5] for the patch.
    - Fixed bug [#1463]: Squiz.Functions.FunctionDuplicateArgument: prevent an Undefined array key PHP
    warning when the sniff encounters a function declaration without parentheses (parse error / live coding).
        - Thanks to [Rodrigo Primo][@rodrigoprimo] for the patch.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2026-d536e7004b");
  script_set_attribute(attribute:"solution", value:
"Update the affected php-pear-PHP-CodeSniffer package.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:44");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:php-pear-PHP-CodeSniffer");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^44([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 44', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '44',
    'pkgs': [
      {'reference':'php-pear-PHP-CodeSniffer-4.0.4-1.fc44', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'php-pear-PHP-CodeSniffer');
}