forked from php-censor/php-censor
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathSecurityChecker.php
More file actions
98 lines (83 loc) · 2.58 KB
/
Copy pathSecurityChecker.php
File metadata and controls
98 lines (83 loc) · 2.58 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
<?php
namespace PHPCensor\Plugin;
use PHPCensor;
use PHPCensor\Builder;
use PHPCensor\Model\Build;
use PHPCensor\Plugin;
use PHPCensor\Model\BuildError;
use PHPCensor\ZeroConfigPluginInterface;
use SensioLabs\Security\SecurityChecker as BaseSecurityChecker;
/**
* SensioLabs Security Checker Plugin
*
* @author Dmitry Khomutov <poisoncorpsee@gmail.com>
*/
class SecurityChecker extends Plugin implements ZeroConfigPluginInterface
{
/**
* @var integer
*/
protected $allowed_warnings;
/**
* @return string
*/
public static function pluginName()
{
return 'security_checker';
}
/**
* {@inheritdoc}
*/
public function __construct(Builder $builder, Build $build, array $options = [])
{
parent::__construct($builder, $build, $options);
$this->allowed_warnings = 0;
if (isset($options['zero_config']) && $options['zero_config']) {
$this->allowed_warnings = -1;
}
if (array_key_exists('allowed_warnings', $options)) {
$this->allowed_warnings = (int)$options['allowed_warnings'];
}
}
/**
* Check if this plugin can be executed.
*
* @param $stage
* @param Builder $builder
* @param Build $build
*
* @return bool
*/
public static function canExecute($stage, Builder $builder, Build $build)
{
$path = $builder->buildPath . DIRECTORY_SEPARATOR . 'composer.lock';
if (file_exists($path) && $stage == Build::STAGE_TEST) {
return true;
}
return false;
}
public function execute()
{
$success = true;
$checker = new BaseSecurityChecker();
$warnings = $checker->check($this->builder->buildPath . DIRECTORY_SEPARATOR . 'composer.lock');
if ($warnings) {
foreach ($warnings as $library => $warning) {
foreach ($warning['advisories'] as $advisory => $data) {
$this->build->reportError(
$this->builder,
'security_checker',
$library . ' (' . $warning['version'] . ")\n" . $data['cve'] . ': ' . $data['title'] . "\n" . $data['link'],
BuildError::SEVERITY_CRITICAL,
'-',
'-'
);
}
}
if ($this->allowed_warnings != -1 && ((int)$checker->getLastVulnerabilityCount() > $this->allowed_warnings)) {
$success = false;
}
}
return $success;
}
}