|
1
|
|
|
<?php |
|
2
|
|
|
|
|
3
|
|
|
namespace Fabrica\Tools\Plugin; |
|
4
|
|
|
|
|
5
|
|
|
use Fabrica\Tools; |
|
6
|
|
|
use Fabrica\Tools\Builder; |
|
7
|
|
|
use Fabrica\Models\Infra\Ci\Build; |
|
8
|
|
|
use Fabrica\Tools\Plugin; |
|
9
|
|
|
use Fabrica\Models\Infra\Ci\BuildError; |
|
10
|
|
|
use Fabrica\Tools\ZeroConfigPluginInterface; |
|
11
|
|
|
use SensioLabs\Security\SecurityChecker as BaseSecurityChecker; |
|
12
|
|
|
|
|
13
|
|
|
/** |
|
14
|
|
|
* SensioLabs Security Checker Plugin |
|
15
|
|
|
* |
|
16
|
|
|
* @author Dmitry Khomutov <[email protected]> |
|
17
|
|
|
*/ |
|
18
|
|
|
class SecurityChecker extends Plugin implements ZeroConfigPluginInterface |
|
19
|
|
|
{ |
|
20
|
|
|
/** |
|
21
|
|
|
* @var int |
|
22
|
|
|
*/ |
|
23
|
|
|
protected $allowedWarnings; |
|
24
|
|
|
|
|
25
|
|
|
/** |
|
26
|
|
|
* @return string |
|
27
|
|
|
*/ |
|
28
|
|
|
public static function pluginName() |
|
29
|
|
|
{ |
|
30
|
|
|
return 'security_checker'; |
|
31
|
|
|
} |
|
32
|
|
|
|
|
33
|
|
|
/** |
|
34
|
|
|
* {@inheritdoc} |
|
35
|
|
|
*/ |
|
36
|
|
|
public function __construct(Builder $builder, Build $build, array $options = []) |
|
37
|
|
|
{ |
|
38
|
|
|
parent::__construct($builder, $build, $options); |
|
39
|
|
|
|
|
40
|
|
|
$this->allowedWarnings = 0; |
|
41
|
|
|
|
|
42
|
|
|
if (isset($options['zero_config']) && $options['zero_config']) { |
|
43
|
|
|
$this->allowedWarnings = -1; |
|
44
|
|
|
} |
|
45
|
|
|
|
|
46
|
|
|
if (array_key_exists('allowed_warnings', $options)) { |
|
47
|
|
|
$this->allowedWarnings = (int)$options['allowed_warnings']; |
|
48
|
|
|
} |
|
49
|
|
|
} |
|
50
|
|
|
|
|
51
|
|
|
/** |
|
52
|
|
|
* {@inheritdoc} |
|
53
|
|
|
*/ |
|
54
|
|
View Code Duplication |
public static function canExecuteOnStage($stage, Build $build) |
|
|
|
|
|
|
55
|
|
|
{ |
|
56
|
|
|
$path = $build->getBuildPath() . 'composer.lock'; |
|
57
|
|
|
|
|
58
|
|
|
if (file_exists($path) && $stage === Build::STAGE_TEST) { |
|
59
|
|
|
return true; |
|
60
|
|
|
} |
|
61
|
|
|
|
|
62
|
|
|
return false; |
|
63
|
|
|
} |
|
64
|
|
|
|
|
65
|
|
|
public function execute() |
|
66
|
|
|
{ |
|
67
|
|
|
$success = true; |
|
68
|
|
|
$checker = new BaseSecurityChecker(); |
|
69
|
|
|
$result = $checker->check($this->builder->buildPath . 'composer.lock'); |
|
70
|
|
|
$warnings = json_decode((string)$result, true); |
|
71
|
|
|
|
|
72
|
|
|
if ($warnings) { |
|
73
|
|
|
foreach ($warnings as $library => $warning) { |
|
74
|
|
|
foreach ($warning['advisories'] as $data) { |
|
75
|
|
|
$this->build->reportError( |
|
76
|
|
|
$this->builder, |
|
77
|
|
|
self::pluginName(), |
|
78
|
|
|
$library . ' (' . $warning['version'] . ")\n" . $data['cve'] . ': ' . $data['title'] . "\n" . $data['link'], |
|
79
|
|
|
BuildError::SEVERITY_CRITICAL, |
|
80
|
|
|
'-', |
|
81
|
|
|
'-' |
|
82
|
|
|
); |
|
83
|
|
|
} |
|
84
|
|
|
} |
|
85
|
|
|
|
|
86
|
|
|
if ($this->allowedWarnings != -1 && ($result->count() > $this->allowedWarnings)) { |
|
87
|
|
|
$success = false; |
|
88
|
|
|
} |
|
89
|
|
|
} |
|
90
|
|
|
|
|
91
|
|
|
return $success; |
|
92
|
|
|
} |
|
93
|
|
|
} |
|
94
|
|
|
|
SierraTecnologia /
fabrica
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.