Using sockets is security-sensitive. It has led in the past to the following vulnerabilities:

Sockets are vulnerable in multiple ways:

This rules flags code that creates sockets. It matches only the direct use of sockets, not use through frameworks or high-level APIs such as the use of http connections.

Ask Yourself Whether

You are at risk if you answered yes to any of these questions.

Recommended Secure Coding Practices

Questionable Code Example

function handle_sockets($domain, $type, $protocol, $port, $backlog, $addr, $hostname, $local_socket, $remote_socket, $fd) {
    socket_create($domain, $type, $protocol); // Questionable
    socket_create_listen($port, $backlog); // Questionable
    socket_addrinfo_bind($addr); // Questionable
    socket_addrinfo_connect($addr); // Questionable
    socket_create_pair($domain, $type, $protocol, $fd);

    fsockopen($hostname); // Questionable
    pfsockopen($hostname); // Questionable
    stream_socket_server($local_socket); // Questionable
    stream_socket_client($remote_socket); // Questionable
    stream_socket_pair($domain, $type, $protocol); // Questionable
}

See