padosoft/laravel-composer-security

Security checker for composer.lock.

Saturday, January 7, 2017
by lopadova
Repository
8 Watchers
28 Stars
878 Installations

PHP
0 Dependents
0 Suggesters
3 Forks
0 Open issues
24 Versions
0 % Grown

The README.md

LARAVEL COMPOSER SECURITY COMMAND

![Software License][ico-license] ![Coverage Status][ico-scrutinizer] ![Total Downloads][ico-downloads] , _(*1)

This is a Laravel 5.1/5.2/5.3 package that provides an artisan command for testing security vulnerabilties into your composer.lock files. Is ready and tested for php7.0 and php7.1 too., _(*2)

LARAVEL COMPOSER SECURITY COMMAND
Table of Contents
PREREQUISITES
Testing
Contributing
Security
API Documentation
Credits
About Padosoft
License

PREREQUISITES

LARAVEL 5.1+ GUZZLE 6+, _(*3)

INSTALL

This package can be installed through Composer., _(*4)

``` bash composer require padosoft/laravel-composer-security, _(*5)

You must install this service provider.

``` php
// config/app.php
'provider' => [
    ...
    Padosoft\LaravelComposerSecurity\ComposerSecurityCheckServiceProvider::class,
    ...
];

You don't need to register the command in app/Console/Kernel.php, because it provides by ComposerSecurtyCheckServiceProvider register() method., _(*6)

You can publish the config file of this package with this command: ``` bash php artisan vendor:publish --provider="Padosoft\LaravelComposerSecurity\ComposerSecurityCheckServiceProvider", _(*7)

The following config file will be published in `config/composer-security-check.php`
``` php
return array(
    'mailSubjectSuccess' => env(
        'SECURITY_CHECK_SUBJECT_SUCCESS',
        '[composer-security-check]: Ok - no vulnerabilities detected.'
    ),
    'mailSubjetcAlarm' => env(
        'SECURITY_CHECK_SUBJECT_ALARM',
        '[composer-security-check]: Alarm - vulnerabilities detected.'
    ),
    'mailFrom' => env('SECURITY_CHECK_MESSAGE_FROM', 'info@example.com'),
    'mailFromName' => env('SECURITY_CHECK_MESSAGE_FROM_NAME', 'Info Example'),
    'mailViewName' => env('SECURITY_CHECK_MAIL_VIEW_NAME', 'composer-security-check::mail'),
    'logFilePath' => env('SECURITY_CHECK_LOG_FILE_PATH', storage_path().'/composersecurityCheck.log')
 );

In config folder you can copy from .env.example the settings for yours .env file used in composer-security-check.php. If you use mathiasgrimm/laravel-env-validator in config folder you'll find and example for validate the env settings., _(*8)

USAGE

When the installation is done you can easily run command to print help:, _(*9)

php artisan composer-security:check

The composer-security:check command looks for every composer.lock file in the given path and foreach composer.lock check for security issues in the project dependencies: php composer-security:check, _(*10)

If you omit path argument, command look into current folder., _(*11)

You can also pass the path as an argument: php composer-security:check /path/to/my/repos, _(*12)

You can use * in path argument as jolly character i.e. /var/www/*/*/, _(*13)

By default, the command displays the result in console, but you can also send an html email by using the --mailoption:, _(*14)

php composer-security:check /path/to/my/repos --mail=mymail@mydomain.me

EXAMPLE:

Here is a basic example to check composer.lock into these dir:, _(*15)

php artisan composer-security:check "/dir/to/check/*/*/"

Here is an example to send output report to mail:, _(*16)

php artisan composer-security:check "/dir/to/check/*/*/" --mail=mymail@mydomain

Here is an example to ignore two composer.lock vulnerabilities into two dir (if command found any vulnerabilities into these dir, write it into output but the email subject isn't set to ALERT):, _(*17)

php artisan composer-security:check "/dir/to/check/*/*/" --mail=mymail@mydomain --whitelist="/dir/to/put/in/witelist,/another/dir/to/put/in/witelist"

SCHEDULE COMMAND

You can schedule a daily (or weekly etc..) report easly, by adding this line into schedule method in app/Console/Kernel.php :, _(*18)

// app/console/Kernel.php

protected function schedule(Schedule $schedule)
{
    ...
    $schedule->command('composer-security:check "/dir/to/check/" --mail=mymail@mydomain')
            ->daily()
            ->withoutOverlapping()
            ->sendOutputTo(Config::get('composer-security-check.logFilePath'));
}

SCREENSHOOTS

OUTPUT CONSOLE: screenshoot , _(*19)

EMAIL VIEW WITH ALERT: screenshoot , _(*20)

EMAIL VIEW WITH VULNERABILITY WITELISTED: screenshoot , _(*21)

Testing

$ composer test

Contributing

Please see CONTRIBUTING and CONDUCT for details., _(*22)

Security

If you discover any security related issues, please email instead of using the issue tracker., _(*23)

API Documentation

Please see API documentation at https://padosoft.github.io/laravel-composer-security - master, _(*24)

Credits

About Padosoft

Padosoft is a software house based in Florence, Italy. Specialized in E-commerce and web sites., _(*25)

License

The MIT License (MIT). Please see License File for more information., _(*26)

The Versions

07/01 2017

dev-master

9999999-dev

Security checker for composer.lock.

project laravel-composer-security

Security checker for composer.lock.

padosoft/laravel-composer-security

The README.md

LARAVEL COMPOSER SECURITY COMMAND

Table of Contents

PREREQUISITES

INSTALL

USAGE

EXAMPLE:

SCHEDULE COMMAND

SCREENSHOOTS

Testing

Contributing

Security

API Documentation

Credits

About Padosoft

License

The Versions

dev-master

The Requires

The Development Requires

by padosoft

1.5.1

The Requires

The Development Requires

by padosoft

1.5.0

The Requires

The Development Requires

by padosoft

dev-laravel53-php71

The Requires

The Development Requires

by padosoft

1.4.6

The Requires

The Development Requires

by padosoft

1.4.5

The Requires

The Development Requires

by padosoft

1.4.4

The Requires

The Development Requires

by padosoft

1.4.3

The Requires

The Development Requires

by padosoft

1.4.2

The Requires

The Development Requires

by padosoft

1.4.1

The Requires

The Development Requires

by padosoft

1.4.0

The Requires

The Development Requires

by padosoft

1.3.4

The Requires

The Development Requires

by padosoft

1.3.3

The Requires

The Development Requires

by padosoft

1.3.2

The Requires

by padosoft

1.3.1

The Requires

by padosoft

1.3

The Requires