Add sinks for popen and proc_open (vimeo#4572)

User input in those two functions could lead to a RCE.

popen: https://www.php.net/manual/en/function.popen.php
proc_open: https://www.php.net/manual/en/function.proc-open.php

dictionaries/InternalTaintSinkMap.php

@@ -39,4 +39,6 @@
 'shell_exec' => [['shell']],
 'system' => [['shell']],
 'unserialize' => [['text']],
+'popen' => [['shell']],
+'proc_open' => [['shell']],
 ];

tests/TaintTest.php

@@ -1615,7 +1615,17 @@ function some_stub(string $r): string {}
 
                 echo some_stub($r);',
                 'error_message' => 'TaintedInput',
-            ]
+            ],
+            'taintPopen' => [
+                '<?php
+                    $cb = popen($_POST[\'x\'], \'r\');',
+                'error_message' => 'TaintedInput',
+            ],
+            'taintProcOpen' => [
+                '<?php
+                    $cb = proc_open($_POST[\'x\'], [], []);',
+                'error_message' => 'TaintedInput',
+            ],
             /*
             // TODO: Stubs do not support this type of inference even with $this->message = $message.
             // Most uses of getMessage() would be with caught exceptions, so this is not representative of real code.