Rule Definition
The software evaluates PHP code via user-controllable inputs. These inputs are not neutralized or are incorrectly neutralized. As a consequence, the PHP code may be completely altered.

Remediation
Prefer using a white list of permitted PHP codes, hard coded.

Violation Code Sample

<?php

$name = $_GET["name"];

evalCode($name);

function evalCode(string $name) {
    eval($name);                     // VIOLATION
}

Fixed Code Sample

<?php

/**
* @psalm-taint-escape eval
*/
function my_escaping_function_for_evaluated_code(string input) : string {
    // Check that input is part of a hard-coded white-list of permitted PHP code
};

$name = $_GET["name"];
$name = my_escaping_function_for_evaluated_code($name);  // USE A FUNCTION ANNOTATED WITH @psalm-taint-escape eval
evalCode($name);

function evalCode(string $name) {
    eval($name);                                         // FIXED
}

CWE-94: Improper Control of Generation of Code ('Code Injection') https://cwe.mitre.org/data/definitions/94.html CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') https://cwe.mitre.org/data/definitions/95.html Open Web Application Security Project (OWASP) https://www.owasp.org/index.php/Top_10-2017_A1-Injection OWASP Top Ten 2021 Category A03:2021 - Injection https://owasp.org/Top10/A03_2021-Injection/