GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Security CI: ASAN/UBSAN + CodeQL by pronskiy · Pull Request #27 · php-debugger/php-debugger

Conversation

@pronskiy

@pronskiy pronskiy commented Mar 22, 2026

Copy link
Copy Markdown
Member

What

Add two security-focused CI workflows:

  1. ASAN + UBSAN — Builds PHP from source with AddressSanitizer and UndefinedBehaviorSanitizer, then runs the full test suite. Catches memory bugs (use-after-free, buffer overflow, fd leaks, signed overflow) at runtime.
  2. CodeQL — GitHub semantic analysis with security-extended queries. Catches common C vulnerability patterns statically (every push/PR + weekly).

Trimmed from the original PR #8 — removed Cppcheck and Clang Static Analyzer (overlap with CodeQL, noisy on inherited Xdebug code).

Attack Surface Analysis

This PR is informed by a threat model of the extension. Key vectors:

Network — DBGp (TCP :9003)

Vector Severity Status
Unauthorized debug attach — anyone reaching :9003 gets code exec via eval Critical Mitigated by localhost-only default; IDE connection prompts planned (SPEC §7.2)
Malicious DBGp client — crafted XML to crash extension (buffer overflow, XXE) High Inherited Xdebug XML parser, not yet audited post-fork
Connection flood / DoS — exhaust FDs via connection spam Medium No rate limiting yet
MitM on DBGp — plaintext XML, sniffable on non-localhost Medium Spec recommends localhost-only

Memory Safety (C extension)

Vector Severity Status
Use-after-free — socket FD reuse after close High Fixed in PR #11 (socket = -1 after close)
FD leak — failed init does not close socket Medium Fixed in PR #11
Buffer overflow in DBGp parser — inherited Xdebug XML parsing High This PR adds ASAN + CodeQL to catch these
Stack overflow — deep recursion in variable serialization Medium max_depth INI limits this

Information Disclosure

Vector Severity Status
Variable inspection exposes secrets — eval/inspect reads env vars, passwords Critical By design (dev tool only, SPEC §1)
Stack traces leak paths Low Unavoidable for a debugger

Not Applicable (yet)

  • Signal handler safety — profiler SIGPROF not implemented yet (Phase 4)
  • Trigger injection — auto-connect default makes triggers irrelevant
  • Network sniffing — localhost only in default config

Files

  • .github/workflows/sanitizers.yml — ASAN + UBSAN on PHP 8.3, 8.4
  • .github/workflows/codeql.yml — CodeQL with security-extended queries

Supersedes #8.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@github-advanced-security

github-advanced-security AI commented Mar 22, 2026

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@pronskiy
pronskiy force-pushed the security-ci branch from 6ab1219 to 322ed0b Compare March 22, 2026 20:33
@pronskiy
pronskiy requested a review from carlos-granados March 23, 2026 13:07
@pronskiy pronskiy added the ci CI/CD, GitHub Actions, testing infrastructure label Mar 24, 2026
@carlos-granados

carlos-granados commented Mar 25, 2026

Copy link
Copy Markdown
Collaborator

@pronskiy I've never used these two tools so I am not really sure what we are expecting to see here. I tried to see the results of the CodeQL scan but they seemed empty. And the ASAN + UBSAN test run was full of errors. Do you have more info on what we are expected to see or how to interpret the results?

One thing: for the CodeQL scan we should use V4 of the GitHub action, V3 is deprecated as far as I can tell from the run output

And in the ASAN + UBSAN check you need to update the version of the actions/cache GitHub action as V4 is also deprecated
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@pronskiy

pronskiy commented Apr 11, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member Author

Thanks for the review, @carlos-granados! Good catch on the CodeQL action version — bumped to v4 now.

As for what to expect from these:

  • ASAN/UBSAN is the main value here — runtime detection of memory safety bugs (use-after-free, buffer overflows, leaks, undefined behavior). For a C extension that hooks into the Zend Engine, seems critical.
  • CodeQL is a static analyzer — lower value for our use case but essentially free to run. It may catch some patterns (format strings, taint flows) but ASAN/UBSAN hopefully will catch far more real bugs at runtime.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
pronskiy added 6 commits April 11, 2026 13:46
@pronskiy
Add security CI workflows
01bf5b1 
- CodeQL: semantic analysis with security-extended queries (every push/PR + weekly)
- ASAN + UBSAN: runtime sanitizers, builds PHP from source with sanitizer flags (every push/PR)
- Cppcheck: fast static analysis for leaks, null derefs, fd leaks (every push/PR)
- Clang Static Analyzer: path-sensitive analysis via scan-build (weekly + manual dispatch)
@pronskiy
Fix UBSAN: xdebug_fiber_entry_dtor function type mismatch
947e5d0 
The hash destructor callback was declared as taking
struct xdebug_fiber_entry * but registered as xdebug_hash_dtor_t
(void (*)(void *)). Calling through the mismatched pointer type
is undefined behavior per C11 §6.5.2.2.

Fix: accept void * and cast inside the function body.
Zero performance impact — identical generated code.
@pronskiy
Fix DBGp test timeouts under ASAN
7eb8cc6 
The DBGp test client had hardcoded 3s/5s socket timeouts. Under ASAN
(2-3x slower), PHP takes longer to respond, causing false test failures.

Fix: make timeouts configurable via DBGP_TIMEOUT env var (defaults
unchanged). Set DBGP_TIMEOUT=10 in the sanitizer CI workflow.
@pronskiy
Run ASAN tests single-threaded
c6b7515 
Parallel ASAN-instrumented PHP processes compete for CPU on CI runners,
causing DBGp socket timeouts. Run with -j1 for reliable results.
@pronskiy
ASAN CI: fail only on sanitizer errors, not test mismatches
dcb9756 
The ASAN-instrumented test suite has ~36-45 test output mismatches
(known XFAIL tests + ASAN-induced timing differences). These are
not memory bugs.

The CI now runs all tests, captures output, and fails ONLY when
actual sanitizer errors are detected (AddressSanitizer, LeakSanitizer,
UBSAN runtime errors). Test output mismatches are logged but
do not block the PR.
@pronskiy
Bump codeql-action to v4
2884b94
@pronskiy
pronskiy force-pushed the security-ci branch from 10f048c to 2884b94 Compare April 11, 2026 11:46
carlos-granados
carlos-granados approved these changes Apr 11, 2026
View reviewed changes

@carlos-granados carlos-granados left a comment

Copy link
Copy Markdown
Collaborator

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, let's give this a go and see if we get some helpful info

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
pronskiy reacted with thumbs up emoji
All reactions
  • 👍 1 reaction
@pronskiy
pronskiy merged commit 52f6d81 into main Apr 13, 2026
15 checks passed

Uh oh!

There was an error while loading. Please reload this page.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@carlos-granados carlos-granados carlos-granados approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

ci CI/CD, GitHub Actions, testing infrastructure

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@pronskiy @github-advanced-security @carlos-granados
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.