Add SAST scanner endpoint

.github/workflows/php.yml

@@ -31,6 +31,12 @@ jobs:
             --form 'file=@upload-test.png;type=image/png' | grep --quiet '"isValid":true'
           curl --fail --silent http://localhost:8080/VulnerableApp-php/images/upload-test.png \
             | grep --quiet --fixed-strings --line-regexp 'test image'
+      - name: Run SAST scanner integration checks
+        run: |
+          curl --fail --silent http://localhost:8080/VulnerableApp-php/scanner/sast \
+            | python3 -c 'import json, sys; data = json.load(sys.stdin); required = {"cwe", "filePath", "line", "numberOfSources", "type"}; assert data and all(required <= set(item) for item in data)'
+          curl --fail --silent http://localhost/scanner/sast \
+            | python3 -c 'import json, sys; data = json.load(sys.stdin); assert data.get("VulnerableApp-php")'
       - name: Stop services
         if: always()
         run: docker compose down --volumes

src/Scanner/SASTScanner.php

@@ -0,0 +1,89 @@
+<?php
+declare(strict_types=1);
+
+namespace scanner;
+
+use fileupload\FileUpload;
+use magichash\MagicHash;
+use nosqlinjection\NoSQLInjection;
+use ReflectionMethod;
+
+class SASTScanner
+{
+    private const CATALOG = [
+        [
+            "class" => FileUpload::class,
+            "filePath" => "src/FileUploadVulnerability/FileUpload.php",
+            "methods" => [
+                "level1",
+                "level2",
+                "level3",
+                "level4",
+                "level5",
+                "level6",
+                "level7",
+                "level8",
+                "level9",
+                "level10",
+                "level11",
+            ],
+            "cwe" => "CWE-434",
+            "type" => "Unrestricted File Upload",
+        ],
+        [
+            "class" => MagicHash::class,
+            "filePath" => "src/MagicHashVulnerability/MagicHash.php",
+            "methods" => ["level1", "level2"],
+            "cwe" => "CWE-704",
+            "type" => "Magic Hash Exploitation",
+        ],
+        [
+            "class" => NoSQLInjection::class,
+            "filePath" => "src/NoSQLInjectionVulnerability/NoSQLInjection.php",
+            "methods" => ["level1", "level2", "level3"],
+            "cwe" => "CWE-943",
+            "type" => "MongoDB NoSQL Injection",
+        ],
+        [
+            "class" => NoSQLInjection::class,
+            "filePath" => "src/NoSQLInjectionVulnerability/NoSQLInjection.php",
+            "methods" => ["level4"],
+            "cwe" => "CWE-256",
+            "type" => "Insecure Credential Storage",
+        ],
+    ];
+
+    /**
+     * Builds the SAST ground-truth rows for all cataloged vulnerable methods.
+     *
+     * @return array<int, array{cwe:string, filePath:string, line:int, numberOfSources:int, type:string}>
+     */
+    private function buildScannerRows(): array
+    {
+        $rows = [];
+
+        foreach (self::CATALOG as $entry) {
+            foreach ($entry["methods"] as $methodName) {
+                $method = new ReflectionMethod($entry["class"], $methodName);
+                $rows[] = [
+                    "cwe" => $entry["cwe"],
+                    "filePath" => $entry["filePath"],
+                    "line" => (int) $method->getStartLine(),
+                    "numberOfSources" => 1,
+                    "type" => $entry["type"],
+                ];
+            }
+        }
+
+        return $rows;
+    }
+
+    /**
+     * Emits the SAST ground-truth catalog as JSON for facade aggregation.
+     */
+    function sast(): void
+    {
+        header("Content-type: application/json");
+        echo json_encode($this->buildScannerRows(), JSON_UNESCAPED_SLASHES);
+    }
+}

src/framework/Bootstrap.php

@@ -6,12 +6,14 @@
 use nosqlinjection\NoSQLInjectionSeeder;
 use ReflectionClass;
 use scanner\DASTScanner;
+use scanner\SASTScanner;
 use framework\Mapper;
 require __DIR__ . "/../FileUploadVulnerability/FileUpload.php";
 require __DIR__ . "/../MagicHashVulnerability/MagicHash.php";
 require __DIR__ . "/../NoSQLInjectionVulnerability/NoSQLInjection.php";
 require __DIR__ . "/../NoSQLInjectionVulnerability/NoSQLInjectionSeeder.php";
 require __DIR__ . "/../Scanner/DASTScanner.php";
+require __DIR__ . "/../Scanner/SASTScanner.php";
 require __DIR__ . "/Mapper.php";
 class Bootstrap
 {
@@ -45,6 +47,9 @@ function get_vulnerability_definitions(): array
         return $vulnerability_definitions;
     }
 
+    /**
+     * Registers vulnerability providers and application routes, including scanner endpoints.
+     */
     function __construct()
     {
         NoSQLInjectionSeeder::seedIfRequired();
@@ -127,6 +132,9 @@ function __construct()
         $this->routing_url_to_mapper[
             "/VulnerableApp-php/scanner/dast"
         ] = new Mapper(new ReflectionClass(DASTScanner::class), "dast");
+        $this->routing_url_to_mapper[
+            "/VulnerableApp-php/scanner/sast"
+        ] = new Mapper(new ReflectionClass(SASTScanner::class), "sast");
     }
 }
 ?>