Evaluation of static analysis tools for detecting XSS vulnerabilities in PHP code: a comparative study using the CrossVul dataset

This thesis presents a comparative evaluation of three distinct static analysis paradigms for detecting Cross-Site Scripting (XSS) vulnerabilities in PHP applications: taint tracking (Psalm), heuristic-based pattern matching (Semgrep), and type-based analysis (PHPStan). Using the Cross Vul dataset of real-world vulnerable code fragments, the study establishes a reproducible methodology to measure key performance metrics, including precision, recall, and F1 score. The results indicate that no single paradigm consistently dominates across all evaluation metrics, reflecting a structural trade-off space in vulnerability detection. PHPStan (augmented with a custom rule) achieved the highest recall (0.2396) and F1 score (0.3244) but produced the highest false positive rate. Psalm proved to be the most conservative and reliable tool, with the highest precision (0.6283). Semgrep occupied an intermediate position, excelling at identifying explicit insecure coding idioms but limited by its lack of global data-flow awareness. Qualitative analysis further identifies recurring failure patterns, such as difficulties in tracking data across persistence boundaries (stored XSS) and context-blindness in HTML attributes. The study concludes that effective XSS detection is best achieved through complementary tool integration rather than reliance on a single analysis strategy.