From db26fce1b10c6c15ad05ec935e37134c8bf20ffd Mon Sep 17 00:00:00 2001 From: Kevin Bond Date: Mon, 5 Nov 2018 13:46:21 -0500 Subject: [PATCH 1/3] make compatible with sensiolabs/security-checker 5.0 --- composer.json | 2 +- composer.lock | 272 ++++++++++++++++++++++++--------- src/Check/SecurityAdvisory.php | 11 +- test/ChecksTest.php | 21 ++- 4 files changed, 229 insertions(+), 77 deletions(-) diff --git a/composer.json b/composer.json index 2de186a..297bcc7 100644 --- a/composer.json +++ b/composer.json @@ -27,7 +27,7 @@ "php-amqplib/php-amqplib": "^2.0", "phpunit/phpunit": "^5.7.27 || 6.5.8 || ^7.1.2", "predis/predis": "^1.0", - "sensiolabs/security-checker": "^1.3", + "sensiolabs/security-checker": "^5.0", "symfony/yaml": "^2.7 || ^3.0 || ^4.0", "zendframework/zend-coding-standard": "~1.0.0", "zendframework/zend-loader": "^2.0" diff --git a/composer.lock b/composer.lock index 5dd7e46..ddf8d51 100644 --- a/composer.lock +++ b/composer.lock @@ -4,9 +4,65 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "74b623d370b9548ee90cb01e769f279f", + "content-hash": "1540166016a984ba33f0e052f4032238", "packages": [], "packages-dev": [ + { + "name": "composer/ca-bundle", + "version": "1.1.3", + "source": { + "type": "git", + "url": "https://github.com/composer/ca-bundle.git", + "reference": "8afa52cd417f4ec417b4bfe86b68106538a87660" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/composer/ca-bundle/zipball/8afa52cd417f4ec417b4bfe86b68106538a87660", + "reference": "8afa52cd417f4ec417b4bfe86b68106538a87660", + "shasum": "" + }, + "require": { + "ext-openssl": "*", + "ext-pcre": "*", + "php": "^5.3.2 || ^7.0" + }, + "require-dev": { + "phpunit/phpunit": "^4.8.35 || ^5.7 || ^6.5", + "psr/log": "^1.0", + "symfony/process": "^2.5 || ^3.0 || ^4.0" + }, + "type": "library", + "extra": { + "branch-alias": { + "dev-master": "1.x-dev" + } + }, + "autoload": { + "psr-4": { + "Composer\\CaBundle\\": "src" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Jordi Boggiano", + "email": "j.boggiano@seld.be", + "homepage": "http://seld.be" + } + ], + "description": "Lets you find a path to the system CA bundle, and includes a fallback to the Mozilla CA bundle.", + "keywords": [ + "cabundle", + "cacert", + "certificate", + "ssl", + "tls" + ], + "time": "2018-10-18T06:09:13+00:00" + }, { "name": "doctrine/annotations", "version": "v1.4.0", @@ -942,22 +998,22 @@ }, { "name": "php-amqplib/php-amqplib", - "version": "v2.7.2", + "version": "2.8.2", "source": { "type": "git", "url": "https://github.com/php-amqplib/php-amqplib.git", - "reference": "dfd3694a86f1a7394d3693485259d4074a6ec79b" + "reference": "20fc065ec03c5944cd3ada9adc56625b449b158e" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/php-amqplib/php-amqplib/zipball/dfd3694a86f1a7394d3693485259d4074a6ec79b", - "reference": "dfd3694a86f1a7394d3693485259d4074a6ec79b", + "url": "https://api.github.com/repos/php-amqplib/php-amqplib/zipball/20fc065ec03c5944cd3ada9adc56625b449b158e", + "reference": "20fc065ec03c5944cd3ada9adc56625b449b158e", "shasum": "" }, "require": { "ext-bcmath": "*", - "ext-mbstring": "*", - "php": ">=5.3.0" + "ext-sockets": "*", + "php": ">=5.4.0" }, "replace": { "videlalvaro/php-amqplib": "self.version" @@ -968,13 +1024,10 @@ "scrutinizer/ocular": "^1.1", "squizlabs/php_codesniffer": "^2.5" }, - "suggest": { - "ext-sockets": "Use AMQPSocketConnection" - }, "type": "library", "extra": { "branch-alias": { - "dev-master": "2.7-dev" + "dev-master": "2.8-dev" } }, "autoload": { @@ -1000,6 +1053,11 @@ "name": "Raúl Araya", "email": "nubeiro@gmail.com", "role": "Maintainer" + }, + { + "name": "Luke Bakken", + "email": "luke@bakken.io", + "role": "Maintainer" } ], "description": "Formerly videlalvaro/php-amqplib. This library is a pure PHP implementation of the AMQP protocol. It's been tested against RabbitMQ.", @@ -1009,7 +1067,7 @@ "queue", "rabbitmq" ], - "time": "2018-02-11T19:28:00+00:00" + "time": "2018-10-31T14:27:47+00:00" }, { "name": "phpdocumentor/reflection-common", @@ -1159,16 +1217,16 @@ }, { "name": "phpspec/prophecy", - "version": "1.7.6", + "version": "1.8.0", "source": { "type": "git", "url": "https://github.com/phpspec/prophecy.git", - "reference": "33a7e3c4fda54e912ff6338c48823bd5c0f0b712" + "reference": "4ba436b55987b4bf311cb7c6ba82aa528aac0a06" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/phpspec/prophecy/zipball/33a7e3c4fda54e912ff6338c48823bd5c0f0b712", - "reference": "33a7e3c4fda54e912ff6338c48823bd5c0f0b712", + "url": "https://api.github.com/repos/phpspec/prophecy/zipball/4ba436b55987b4bf311cb7c6ba82aa528aac0a06", + "reference": "4ba436b55987b4bf311cb7c6ba82aa528aac0a06", "shasum": "" }, "require": { @@ -1180,12 +1238,12 @@ }, "require-dev": { "phpspec/phpspec": "^2.5|^3.2", - "phpunit/phpunit": "^4.8.35 || ^5.7 || ^6.5" + "phpunit/phpunit": "^4.8.35 || ^5.7 || ^6.5 || ^7.1" }, "type": "library", "extra": { "branch-alias": { - "dev-master": "1.7.x-dev" + "dev-master": "1.8.x-dev" } }, "autoload": { @@ -1218,7 +1276,7 @@ "spy", "stub" ], - "time": "2018-04-18T13:57:24+00:00" + "time": "2018-08-05T17:53:17+00:00" }, { "name": "phpunit/php-code-coverage", @@ -1712,16 +1770,16 @@ }, { "name": "psr/log", - "version": "1.0.2", + "version": "1.1.0", "source": { "type": "git", "url": "https://github.com/php-fig/log.git", - "reference": "4ebe3a8bf773a19edfe0a84b6585ba3d401b724d" + "reference": "6c001f1daafa3a3ac1d8ff69ee4db8e799a654dd" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/php-fig/log/zipball/4ebe3a8bf773a19edfe0a84b6585ba3d401b724d", - "reference": "4ebe3a8bf773a19edfe0a84b6585ba3d401b724d", + "url": "https://api.github.com/repos/php-fig/log/zipball/6c001f1daafa3a3ac1d8ff69ee4db8e799a654dd", + "reference": "6c001f1daafa3a3ac1d8ff69ee4db8e799a654dd", "shasum": "" }, "require": { @@ -1755,7 +1813,7 @@ "psr", "psr-3" ], - "time": "2016-10-10T12:19:37+00:00" + "time": "2018-11-20T15:27:04+00:00" }, { "name": "sebastian/code-unit-reverse-lookup", @@ -2272,21 +2330,22 @@ }, { "name": "sensiolabs/security-checker", - "version": "v1.3.4", + "version": "v5.0.1", "source": { "type": "git", "url": "https://github.com/sensiolabs/security-checker.git", - "reference": "da1f9d19c80eac2b6ae8043bb92b7c7a16d00713" + "reference": "9ea927417c949039a9cfb0d92af76fd1c538d9e9" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/sensiolabs/security-checker/zipball/da1f9d19c80eac2b6ae8043bb92b7c7a16d00713", - "reference": "da1f9d19c80eac2b6ae8043bb92b7c7a16d00713", + "url": "https://api.github.com/repos/sensiolabs/security-checker/zipball/9ea927417c949039a9cfb0d92af76fd1c538d9e9", + "reference": "9ea927417c949039a9cfb0d92af76fd1c538d9e9", "shasum": "" }, "require": { - "ext-curl": "*", - "symfony/console": "~2.0" + "composer/ca-bundle": "^1.0", + "php": ">=5.5.9", + "symfony/console": "~2.7|~3.0|~4.0" }, "bin": [ "security-checker" @@ -2294,12 +2353,12 @@ "type": "library", "extra": { "branch-alias": { - "dev-master": "1.3-dev" + "dev-master": "5.0-dev" } }, "autoload": { - "psr-0": { - "SensioLabs\\Security": "" + "psr-4": { + "SensioLabs\\Security\\": "SensioLabs/Security" } }, "notification-url": "https://packagist.org/downloads/", @@ -2313,20 +2372,20 @@ } ], "description": "A security checker for your composer.lock", - "time": "2014-07-08T18:12:35+00:00" + "time": "2018-10-16T10:30:44+00:00" }, { "name": "squizlabs/php_codesniffer", - "version": "2.9.1", + "version": "2.9.2", "source": { "type": "git", "url": "https://github.com/squizlabs/PHP_CodeSniffer.git", - "reference": "dcbed1074f8244661eecddfc2a675430d8d33f62" + "reference": "2acf168de78487db620ab4bc524135a13cfe6745" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/squizlabs/PHP_CodeSniffer/zipball/dcbed1074f8244661eecddfc2a675430d8d33f62", - "reference": "dcbed1074f8244661eecddfc2a675430d8d33f62", + "url": "https://api.github.com/repos/squizlabs/PHP_CodeSniffer/zipball/2acf168de78487db620ab4bc524135a13cfe6745", + "reference": "2acf168de78487db620ab4bc524135a13cfe6745", "shasum": "" }, "require": { @@ -2391,41 +2450,49 @@ "phpcs", "standards" ], - "time": "2017-05-22T02:43:20+00:00" + "time": "2018-11-07T22:31:41+00:00" }, { "name": "symfony/console", - "version": "v2.8.42", + "version": "v3.4.19", "source": { "type": "git", "url": "https://github.com/symfony/console.git", - "reference": "e8e59b74ad1274714dad2748349b55e3e6e630c7" + "reference": "8f80fc39bbc3b7c47ee54ba7aa2653521ace94bb" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/console/zipball/e8e59b74ad1274714dad2748349b55e3e6e630c7", - "reference": "e8e59b74ad1274714dad2748349b55e3e6e630c7", + "url": "https://api.github.com/repos/symfony/console/zipball/8f80fc39bbc3b7c47ee54ba7aa2653521ace94bb", + "reference": "8f80fc39bbc3b7c47ee54ba7aa2653521ace94bb", "shasum": "" }, "require": { - "php": ">=5.3.9", - "symfony/debug": "^2.7.2|~3.0.0", + "php": "^5.5.9|>=7.0.8", + "symfony/debug": "~2.8|~3.0|~4.0", "symfony/polyfill-mbstring": "~1.0" }, + "conflict": { + "symfony/dependency-injection": "<3.4", + "symfony/process": "<3.3" + }, "require-dev": { "psr/log": "~1.0", - "symfony/event-dispatcher": "~2.1|~3.0.0", - "symfony/process": "~2.1|~3.0.0" + "symfony/config": "~3.3|~4.0", + "symfony/dependency-injection": "~3.4|~4.0", + "symfony/event-dispatcher": "~2.8|~3.0|~4.0", + "symfony/lock": "~3.4|~4.0", + "symfony/process": "~3.3|~4.0" }, "suggest": { "psr/log-implementation": "For using the console logger", "symfony/event-dispatcher": "", + "symfony/lock": "", "symfony/process": "" }, "type": "library", "extra": { "branch-alias": { - "dev-master": "2.8-dev" + "dev-master": "3.4-dev" } }, "autoload": { @@ -2452,37 +2519,36 @@ ], "description": "Symfony Console Component", "homepage": "https://symfony.com", - "time": "2018-05-15T21:17:45+00:00" + "time": "2018-11-26T12:48:07+00:00" }, { "name": "symfony/debug", - "version": "v3.0.9", + "version": "v3.4.19", "source": { "type": "git", "url": "https://github.com/symfony/debug.git", - "reference": "697c527acd9ea1b2d3efac34d9806bf255278b0a" + "reference": "2016b3eec2e49c127dd02d0ef44a35c53181560d" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/debug/zipball/697c527acd9ea1b2d3efac34d9806bf255278b0a", - "reference": "697c527acd9ea1b2d3efac34d9806bf255278b0a", + "url": "https://api.github.com/repos/symfony/debug/zipball/2016b3eec2e49c127dd02d0ef44a35c53181560d", + "reference": "2016b3eec2e49c127dd02d0ef44a35c53181560d", "shasum": "" }, "require": { - "php": ">=5.5.9", + "php": "^5.5.9|>=7.0.8", "psr/log": "~1.0" }, "conflict": { "symfony/http-kernel": ">=2.3,<2.3.24|~2.4.0|>=2.5,<2.5.9|>=2.6,<2.6.2" }, "require-dev": { - "symfony/class-loader": "~2.8|~3.0", - "symfony/http-kernel": "~2.8|~3.0" + "symfony/http-kernel": "~2.8|~3.0|~4.0" }, "type": "library", "extra": { "branch-alias": { - "dev-master": "3.0-dev" + "dev-master": "3.4-dev" } }, "autoload": { @@ -2509,20 +2575,78 @@ ], "description": "Symfony Debug Component", "homepage": "https://symfony.com", - "time": "2016-07-30T07:22:48+00:00" + "time": "2018-11-11T19:48:54+00:00" + }, + { + "name": "symfony/polyfill-ctype", + "version": "v1.10.0", + "source": { + "type": "git", + "url": "https://github.com/symfony/polyfill-ctype.git", + "reference": "e3d826245268269cd66f8326bd8bc066687b4a19" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/symfony/polyfill-ctype/zipball/e3d826245268269cd66f8326bd8bc066687b4a19", + "reference": "e3d826245268269cd66f8326bd8bc066687b4a19", + "shasum": "" + }, + "require": { + "php": ">=5.3.3" + }, + "suggest": { + "ext-ctype": "For best performance" + }, + "type": "library", + "extra": { + "branch-alias": { + "dev-master": "1.9-dev" + } + }, + "autoload": { + "psr-4": { + "Symfony\\Polyfill\\Ctype\\": "" + }, + "files": [ + "bootstrap.php" + ] + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Symfony Community", + "homepage": "https://symfony.com/contributors" + }, + { + "name": "Gert de Pagter", + "email": "BackEndTea@gmail.com" + } + ], + "description": "Symfony polyfill for ctype functions", + "homepage": "https://symfony.com", + "keywords": [ + "compatibility", + "ctype", + "polyfill", + "portable" + ], + "time": "2018-08-06T14:22:27+00:00" }, { "name": "symfony/polyfill-mbstring", - "version": "v1.8.0", + "version": "v1.10.0", "source": { "type": "git", "url": "https://github.com/symfony/polyfill-mbstring.git", - "reference": "3296adf6a6454a050679cde90f95350ad604b171" + "reference": "c79c051f5b3a46be09205c73b80b346e4153e494" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/3296adf6a6454a050679cde90f95350ad604b171", - "reference": "3296adf6a6454a050679cde90f95350ad604b171", + "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/c79c051f5b3a46be09205c73b80b346e4153e494", + "reference": "c79c051f5b3a46be09205c73b80b346e4153e494", "shasum": "" }, "require": { @@ -2534,7 +2658,7 @@ "type": "library", "extra": { "branch-alias": { - "dev-master": "1.8-dev" + "dev-master": "1.9-dev" } }, "autoload": { @@ -2568,27 +2692,31 @@ "portable", "shim" ], - "time": "2018-04-26T10:06:28+00:00" + "time": "2018-09-21T13:07:52+00:00" }, { "name": "symfony/yaml", - "version": "v3.3.17", + "version": "v3.4.19", "source": { "type": "git", "url": "https://github.com/symfony/yaml.git", - "reference": "af615970e265543a26ee712c958404eb9b7ac93d" + "reference": "291e13d808bec481eab83f301f7bff3e699ef603" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/yaml/zipball/af615970e265543a26ee712c958404eb9b7ac93d", - "reference": "af615970e265543a26ee712c958404eb9b7ac93d", + "url": "https://api.github.com/repos/symfony/yaml/zipball/291e13d808bec481eab83f301f7bff3e699ef603", + "reference": "291e13d808bec481eab83f301f7bff3e699ef603", "shasum": "" }, "require": { - "php": "^5.5.9|>=7.0.8" + "php": "^5.5.9|>=7.0.8", + "symfony/polyfill-ctype": "~1.8" + }, + "conflict": { + "symfony/console": "<3.4" }, "require-dev": { - "symfony/console": "~2.8|~3.0" + "symfony/console": "~3.4|~4.0" }, "suggest": { "symfony/console": "For validating YAML files using the lint command" @@ -2596,7 +2724,7 @@ "type": "library", "extra": { "branch-alias": { - "dev-master": "3.3-dev" + "dev-master": "3.4-dev" } }, "autoload": { @@ -2623,7 +2751,7 @@ ], "description": "Symfony Yaml Component", "homepage": "https://symfony.com", - "time": "2018-01-20T15:04:53+00:00" + "time": "2018-11-11T19:48:54+00:00" }, { "name": "webmozart/assert", diff --git a/src/Check/SecurityAdvisory.php b/src/Check/SecurityAdvisory.php index de31036..636f2c0 100644 --- a/src/Check/SecurityAdvisory.php +++ b/src/Check/SecurityAdvisory.php @@ -8,6 +8,7 @@ namespace ZendDiagnostics\Check; use InvalidArgumentException; +use SensioLabs\Security\Result; use SensioLabs\Security\SecurityChecker; use ZendDiagnostics\Result\Failure; use ZendDiagnostics\Result\Success; @@ -42,6 +43,12 @@ public function __construct($lockFilePath = null) )); } + if (! class_exists('SensioLabs\Security\Result')) { + throw new InvalidArgumentException( + 'You must have sensiolabs/security-checker version 5+ to use this check.' + ); + } + if (! $lockFilePath) { if (! file_exists('composer.lock')) { throw new InvalidArgumentException( @@ -78,9 +85,7 @@ public function check() $advisories = $this->securityChecker->check($this->lockFilePath, 'json'); - if (is_string($advisories)) { - $advisories = @json_decode($advisories); - } + $advisories = @json_decode((string) $advisories, true); if (! is_array($advisories)) { return new Warning('Could not parse response from security advisory service.'); diff --git a/test/ChecksTest.php b/test/ChecksTest.php index aef81dc..86fc818 100644 --- a/test/ChecksTest.php +++ b/test/ChecksTest.php @@ -12,6 +12,7 @@ use Exception; use InvalidArgumentException; use PHPUnit\Framework\TestCase; +use SensioLabs\Security\Result; use SensioLabs\Security\SecurityChecker; use stdClass; use ZendDiagnostics\Check\Callback; @@ -614,12 +615,13 @@ public function testSecurityAdvisoryFailure() $checker->expects($this->once()) ->method('check') ->with($this->equalTo($secureComposerLock)) - ->will($this->returnValue('[{"a":1},{"b":2},{"c":3}]')); + ->will($this->returnValue(new Result(3, '[{"a":1},{"b":2},{"c":3}]', 'json'))); $check = new SecurityAdvisory($secureComposerLock); $check->setSecurityChecker($checker); $result = $check->check(); $this->assertInstanceOf(Failure::class, $result); + $this->assertSame('Found security advisories for 3 composer package(s)', $result->getMessage()); } /** @@ -655,6 +657,23 @@ public function testSecurityAdvisoryCheckerException() $this->assertInstanceOf(Warning::class, $result); } + /** + * @depends testSecurityAdvisory + */ + public function testSecurityAdvisoryCheckerSuccess() + { + $secureComposerLock = __DIR__ . '/TestAsset/secure-composer.lock'; + $checker = $this->createMock(SecurityChecker::class); + $checker->expects($this->once()) + ->method('check') + ->with($this->equalTo($secureComposerLock)) + ->will($this->returnValue(new Result(0, '[]', 'json'))); + $check = new SecurityAdvisory($secureComposerLock); + $check->setSecurityChecker($checker); + $result = $check->check(); + $this->assertInstanceOf(Success::class, $result); + } + public function testPhpVersionInvalidVersion() { $this->expectException(InvalidArgumentException::class); From 97dc3d2c56b4c863c12992d4574cfc5e02d8b578 Mon Sep 17 00:00:00 2001 From: Matthew Weier O'Phinney Date: Wed, 9 Jan 2019 12:22:36 -0600 Subject: [PATCH 2/3] Adds CHANGELOG entry for #95 --- CHANGELOG.md | 26 ++------------------------ 1 file changed, 2 insertions(+), 24 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bfc631b..a5adb03 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ All notable changes to this project will be documented in this file, in reverse Releases prior to 1.2.0 did not have entries. -## 1.4.0 - TBD +## 1.4.0 - 2019-01-09 ### Added @@ -12,29 +12,7 @@ Releases prior to 1.2.0 did not have entries. ### Changed -- Nothing. - -### Deprecated - -- Nothing. - -### Removed - -- Nothing. - -### Fixed - -- Nothing. - -## 1.3.2 - TBD - -### Added - -- Nothing. - -### Changed - -- Nothing. +- [#95](https://github.com/zendframework/zenddiagnostics/pull/95) changes the minimum supported version of sensiolabs/security-checker from 1.3 to 5.0. ### Deprecated From 81af0b9e15fa3b9cc9f9f7e184f2e98c6aa539f4 Mon Sep 17 00:00:00 2001 From: Matthew Weier O'Phinney Date: Wed, 9 Jan 2019 12:23:57 -0600 Subject: [PATCH 3/3] Updates branch aliases - dev-master: 1.4.x-dev - dev-develop: 1.5.x-dev --- composer.json | 4 ++-- composer.lock | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/composer.json b/composer.json index 297bcc7..0fad504 100644 --- a/composer.json +++ b/composer.json @@ -56,8 +56,8 @@ }, "extra": { "branch-alias": { - "dev-master": "1.3.x-dev", - "dev-develop": "1.4.x-dev" + "dev-master": "1.4.x-dev", + "dev-develop": "1.5.x-dev" } }, "scripts": { diff --git a/composer.lock b/composer.lock index ddf8d51..c0951e5 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "1540166016a984ba33f0e052f4032238", + "content-hash": "1cfa25b5c1401f2ad5168292b6b52ad1", "packages": [], "packages-dev": [ {