SonarLint missing PHP exec() security vulnerability (command injection)

[Colin]

Hey there.

See this:

@Julien_HENRY

1. Vulnerabilities raised by the Taint Analyzer (SQL Injection, …) are issues detected in SonarQube commercial editions or SonarCloud, that are also not detected by SonarLint (rule key starting by javasecurity , phpsecurity or roslyn.sonaranalyzer.security.cs ). Running tainted analysis in the IDE is currently not practical mainly for performance reason. SonarLint can display taint vulnerabilities that have been detected by SonarQube or SonarCloud, to help navigation/investigation. But the actual detection happen during SonarQube/SonarCloud analysis.