Phase 1 (#33)

* chore: Exclude CLAUDE.md from Cargo.toml

* feat: add callgraph module and integrate into main analysis flow

* feat: enhance CLI with new severity filtering and analysis modes

* feat: update CHANGELOG with recent enhancements and fixes to severity filtering and output handling

* feat: implement state-model dataflow analysis for resource lifecycle and auth state

* feat: enhance diagnostic output formatting and add evidence structure

* feat: implement attack surface ranking for diagnostics with scoring and sorting

* feat: add comprehensive documentation for installation, usage, and rules reference

* feat: add multiple language support for command execution and evaluation endpoints

* feat: implement inline suppression for findings using `nyx:ignore` comments

* feat: add confidence levels to AST patterns and update output structure

* feat: implement low-noise prioritization system with category filtering, rollup grouping, and configurable budgets

* feat: bump version to 0.4.0 and update changelog with new features and improvements

* feat: add dead code allowances to various functions in mod.rs and real_world_tests.rs

tests/fixtures/patterns/php/negative.php

@@ -0,0 +1,25 @@
+<?php
+// Negative fixture: none of these should trigger security patterns.
+
+function safe_query($pdo, $user) {
+    $stmt = $pdo->prepare("SELECT * FROM users WHERE name = ?");
+    $stmt->execute([$user]);
+}
+
+function safe_hash($data) {
+    return hash("sha256", $data);
+}
+
+function safe_random() {
+    return random_int(1, 100);
+}
+
+function safe_include() {
+    include "config.php";
+}
+
+function safe_string_ops() {
+    $x = "hello";
+    $y = strtoupper($x);
+    $z = strlen($y);
+}

tests/fixtures/patterns/php/positive.php

@@ -0,0 +1,57 @@
+<?php
+// Positive fixture: each snippet should trigger the named pattern.
+
+// php.code_exec.eval
+function trigger_eval($code) {
+    eval($code);
+}
+
+// php.code_exec.create_function
+function trigger_create_function() {
+    $fn = create_function('$a', 'return $a * 2;');
+}
+
+// php.code_exec.preg_replace_e
+function trigger_preg_replace_e($input) {
+    preg_replace('/test/e', 'strtoupper("$1")', $input);
+}
+
+// php.code_exec.assert_string
+function trigger_assert($code) {
+    assert("strlen('$code') > 0");
+}
+
+// php.cmdi.system
+function trigger_system($cmd) {
+    system($cmd);
+}
+
+// php.deser.unserialize
+function trigger_unserialize($data) {
+    unserialize($data);
+}
+
+// php.sqli.query_concat
+function trigger_sql_concat($user) {
+    mysql_query("SELECT * FROM users WHERE name = '" . $user . "'");
+}
+
+// php.path.include_variable
+function trigger_include($path) {
+    include $path;
+}
+
+// php.crypto.md5
+function trigger_md5($data) {
+    md5($data);
+}
+
+// php.crypto.sha1
+function trigger_sha1($data) {
+    sha1($data);
+}
+
+// php.crypto.rand
+function trigger_rand() {
+    $r = rand();
+}