Added Cap::DATA_EXFIL and taint fp and fn fixes on real repos (#59)

* feat: Enhance data exfiltration detection with source sensitivity gating for cookies and headers

* feat: Implement cross-file data exfiltration detection with parameter-specific gate filters

* feat: Add calibration tests and refine DATA_EXFIL severity scoring logic

* feat: Introduce per-detector configuration for data exfiltration suppression

* feat: Enhance DATA_EXFIL findings with destination field tracking in diagnostics and SARIF output

* feat: Add tainted body and URL handling for data exfiltration detection

* feat: Add integration tests and fixtures for DATA_EXFIL and SSRF detection in Go

* feat: Add Java integration tests and fixtures for DATA_EXFIL detection across multiple HTTP clients

* feat: Add synthetic externals handling for closure-captured variables in SSA

* feat: Implement closure-based suppression for resource leak findings

* feat: Add regression guards for shell-injection and taint propagation in for-of destructure patterns

* feat: Implement constructor cap narrowing for data exfiltration detection in HTTP request builders

* feat: Add gated sinks for data exfiltration detection in C and C++ using curl_easy_setopt

* feat: Implement DATA_EXFIL cap parity for backwards analysis and add integration tests

* feat: Add data exfiltration sinks for various languages and enhance documentation

* refactor: Simplify formatting and improve readability in various files

* refactor: Improve readability by simplifying conditional statements and adding clippy linting

* docs: Update CHANGELOG and comments for data exfiltration features and configuration

* docs: Clarify configuration instructions for data exfiltration trusted destinations

* docs: Enhance comments for evidence routing logic in data exfiltration

src/labels/php.rs

@@ -1,4 +1,6 @@
-use crate::labels::{Cap, DataLabel, Kind, LabelRule, ParamConfig, RuntimeLabelRule};
+use crate::labels::{
+    Cap, DataLabel, GateActivation, Kind, LabelRule, ParamConfig, RuntimeLabelRule, SinkGate,
+};
 use crate::utils::project::{DetectedFramework, FrameworkContext};
 use phf::{Map, phf_map};
 
@@ -138,8 +140,67 @@ pub static RULES: &[LabelRule] = &[
         label: DataLabel::Sink(Cap::SSRF),
         case_sensitive: false,
     },
+    // ── Cross-boundary data exfiltration ──────────────────────────────────
+    //
+    // Body-bearing outbound HTTP verb methods on the major PHP HTTP clients.
+    // Flat sinks here compose with the SSRF rule on `curl_exec` /
+    // `file_get_contents` via multi-label classification.  The
+    // source-sensitivity gate in `effective_sink_caps` strips DATA_EXFIL
+    // when the contributing source is `Plain` (`$_GET`, `$_POST`, `$_REQUEST`),
+    // so this only fires for sensitive sources (cookies / sessions /
+    // server-side state / env / file / db reads).
+    //
+    // Covered clients:
+    // * `Guzzle\Client::post/put/patch` — guzzlehttp/guzzle
+    //   matched by suffix on the verb method (chained `$client->post(...)`).
+    // * `Symfony\HttpClient::request` — symfony/http-client
+    //   request($method, $url, ['body' => $payload, 'json' => $data, ...])
+    // * `Http::post` — Laravel HTTP facade (over Guzzle)
+    LabelRule {
+        matchers: &[
+            "Client.post",
+            "Client.put",
+            "Client.patch",
+            "Client.request",
+            "HttpClient.post",
+            "HttpClient.put",
+            "HttpClient.patch",
+            "HttpClient.request",
+            "Http.post",
+            "Http.put",
+            "Http.patch",
+        ],
+        label: DataLabel::Sink(Cap::DATA_EXFIL),
+        case_sensitive: true,
+    },
 ];
 
+/// Gated sinks for PHP.
+///
+/// `curl_setopt($ch, CURLOPT_POSTFIELDS, $payload)` is the canonical
+/// non-OO PHP HTTP-egress payload binding.  The activation arg (index 1) is
+/// a `define`d constant: `CURLOPT_POSTFIELDS` (and the byref-copying variant
+/// `CURLOPT_COPYPOSTFIELDS`) carry the request body, while other CURLOPT_*
+/// constants designate URL / auth / TLS / behaviour, none of which is
+/// DATA_EXFIL-relevant.  Gating on the constant identifier keeps the rule
+/// from over-firing on `curl_setopt($ch, CURLOPT_URL, $url)` (covered
+/// elsewhere by the `curl_exec` SSRF flat sink).
+///
+/// Identifier-based activation is enabled via the macro-arg fallback in
+/// `cfg::mod::classify_gated_sink` for `lang == "php"`.
+pub static GATED_SINKS: &[SinkGate] = &[SinkGate {
+    callee_matcher: "curl_setopt",
+    arg_index: 1,
+    dangerous_values: &["CURLOPT_POSTFIELDS", "CURLOPT_COPYPOSTFIELDS"],
+    dangerous_prefixes: &[],
+    label: DataLabel::Sink(Cap::DATA_EXFIL),
+    case_sensitive: true,
+    payload_args: &[2],
+    keyword_name: None,
+    dangerous_kwargs: &[],
+    activation: GateActivation::ValueMatch,
+}];
+
 pub static KINDS: Map<&'static str, Kind> = phf_map! {
     // control-flow
     "if_statement"                  => Kind::If,