-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathSecurityChecker.php
More file actions
130 lines (106 loc) · 3.68 KB
/
Copy pathSecurityChecker.php
File metadata and controls
130 lines (106 loc) · 3.68 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
<?php
declare(strict_types=1);
namespace PHPCensor\Plugins\CodeQuality;
use PHPCensor\Common\Build\BuildErrorInterface;
use PHPCensor\Common\Build\BuildInterface;
use PHPCensor\Common\Exception\Exception;
use PHPCensor\Common\Plugin\Plugin;
use PHPCensor\Common\Plugin\ZeroConfigPluginInterface;
/**
* SensioLabs Security Checker Plugin
*
* @package PHP Censor
* @subpackage Plugins
*
* @author Dmitry Khomutov <poisoncorpsee@gmail.com>
*/
class SecurityChecker extends Plugin implements ZeroConfigPluginInterface
{
private int $allowedWarnings = 0;
private string $binaryType = 'symfony';
/**
* @var string[]
*/
private array $allowedBinaryTypes = [
'symfony',
'local-php-security-checker',
];
/**
* {@inheritDoc}
*/
public static function getName(): string
{
return 'security_checker';
}
/**
* {@inheritDoc}
*/
public function execute(): bool
{
$success = true;
$composerLockFile = $this->build->getBuildPath() . 'composer.lock';
if (!\is_file($composerLockFile)) {
throw new Exception('Lock file (composer.lock) does not exist.');
}
if ('symfony' === $this->binaryType) {
$cmd = '%s check:security --format=json --dir=%s';
$executable = $this->commandExecutor->findBinary(['symfony']);
} else {
$cmd = '%s --format=json --path="%s"';
$executable = $this->commandExecutor->findBinary(['local-php-security-checker']);
}
if (!$this->build->isDebug()) {
$this->commandExecutor->disableCommandOutput();
}
// works with dir, composer.lock, composer.json
$this->commandExecutor->executeCommand($cmd, $executable, $composerLockFile);
$this->commandExecutor->enableCommandOutput();
$result = $this->commandExecutor->getLastCommandOutput();
$warnings = \json_decode($result, true);
if ($warnings) {
foreach ($warnings as $library => $warning) {
foreach ($warning['advisories'] as $data) {
$this->buildErrorWriter->write(
$this->build->getId(),
self::getName(),
($library . ' (' . $warning['version'] . ")\n" . $data['cve'] . ': ' . $data['title'] . "\n" . $data['link']),
BuildErrorInterface::SEVERITY_CRITICAL
);
}
}
if ($this->allowedWarnings !== -1 && (\count($warnings) > $this->allowedWarnings)) {
$success = false;
}
} elseif (null === $warnings && $result) {
throw new Exception('invalid json: '.$result);
}
return $success;
}
/**
* {@inheritDoc}
*/
public static function canExecute(string $stage, BuildInterface $build): bool
{
$path = $build->getBuildPath() . 'composer.lock';
if (\file_exists($path) && $stage === BuildInterface::STAGE_TEST) {
return true;
}
return false;
}
/**
* {@inheritDoc}
*/
protected function initPluginSettings(): void
{
if ($this->options->has('zero_config') && $this->options->get('zero_config', false)) {
$this->allowedWarnings = -1;
}
if (
$this->options->has('binary_type') &&
\in_array((string)$this->options->get('binary_type'), $this->allowedBinaryTypes, true)
) {
$this->binaryType = (string)$this->options->get('binary_type');
}
$this->allowedWarnings = (int)$this->options->get('allowed_warnings', $this->allowedWarnings);
}
}