How to create security advisories for PHP? about security-advisories HOT 6 CLOSED

The "problem" with PHP is that the "installed" version is not in your vendor dir and as such the exact version is not listed in the composer.lock file. So, there is no way to check the vuln. via Composer.

from security-advisories.

My idea is when you run command

php app/console security:check /path/to/another/composer.lock

That command will be advice the security of running PHP as well.
and That command will search security issues in this repo.

I think this feature is very helpful for all PHP developer.

What do you think?

ref: http://symfony.com/blog/new-in-symfony-2-6-the-security-check-command

from security-advisories.

but the PHP version you run in prod might be different than the one you run locally (it can often be a different patch version)

from security-advisories.

I have not use different version between prod and my local.
As you mentions that different version of PHP you running, It must have a tool to give you security issues both of prod and local so you will be aware that take the risk or not and make decision to update version or not.

That is all my though.

from security-advisories.

I agree with @fabpot on not bundling that check in with this tool. @enygma and I had a similar chat about including a PHP version checker in his ini scanner (psecio/iniscan#59). In the end he put together a separate tool for this at https://github.com/psecio/versionscan.

from security-advisories.

just try versionscan. it's ok so closed this ticket.

from security-advisories.