diff --git a/.travis.yml b/.travis.yml index cd687b56..9d921301 100644 --- a/.travis.yml +++ b/.travis.yml @@ -40,3 +40,4 @@ before_script: script: - phpdbg -qrr vendor/bin/phpunit --coverage-text + - php artisan security:check diff --git a/app/Console/Commands/SecurityCheck.php b/app/Console/Commands/SecurityCheck.php new file mode 100644 index 00000000..c2888b0f --- /dev/null +++ b/app/Console/Commands/SecurityCheck.php @@ -0,0 +1,61 @@ +securityChecker = $securityChecker; + } + + /** + * Execute the console command. + * + * @return mixed + */ + public function handle() + { + $alerts = $this->securityChecker->check(base_path() . '/composer.lock'); + if (count($alerts) === 0) { + $this->info('No security vulnerabilities found.'); + + return 0; + } + $this->error('vulnerabilities found'); + + return 1; + } +} diff --git a/app/Console/Kernel.php b/app/Console/Kernel.php index 622e774b..ad10b8f8 100644 --- a/app/Console/Kernel.php +++ b/app/Console/Kernel.php @@ -13,7 +13,7 @@ class Kernel extends ConsoleKernel * @var array */ protected $commands = [ - // + Commands\SecurityCheck::class, ]; /** diff --git a/composer.json b/composer.json index f4656161..dd483484 100644 --- a/composer.json +++ b/composer.json @@ -21,7 +21,8 @@ "spatie/laravel-medialibrary": "^4.0", "league/flysystem-aws-s3-v3": "^1.0", "phaza/laravel-postgis": "~3.1", - "lcobucci/jwt": "^3.1" + "lcobucci/jwt": "^3.1", + "sensiolabs/security-checker": "^3.0" }, "require-dev": { "fzaninotto/faker": "~1.4", diff --git a/composer.lock b/composer.lock index 54a9227d..262b7a9a 100644 --- a/composer.lock +++ b/composer.lock @@ -4,8 +4,8 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file", "This file is @generated automatically" ], - "hash": "7a7231eebef62c0fb518cf030d531d95", - "content-hash": "3815acce9215a64c27a68ada0123dc48", + "hash": "37eb5ade7abcb0c16b9c6af08db1b116", + "content-hash": "a87758569765f8b751e2c0cf72e3a1f0", "packages": [ { "name": "anahkiasen/underscore-php", @@ -2793,6 +2793,50 @@ ], "time": "2016-08-02 18:39:32" }, + { + "name": "sensiolabs/security-checker", + "version": "v3.0.2", + "source": { + "type": "git", + "url": "https://github.com/sensiolabs/security-checker.git", + "reference": "21696b0daa731064c23cfb694c60a2584a7b6e93" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/sensiolabs/security-checker/zipball/21696b0daa731064c23cfb694c60a2584a7b6e93", + "reference": "21696b0daa731064c23cfb694c60a2584a7b6e93", + "shasum": "" + }, + "require": { + "symfony/console": "~2.0|~3.0" + }, + "bin": [ + "security-checker" + ], + "type": "library", + "extra": { + "branch-alias": { + "dev-master": "3.0-dev" + } + }, + "autoload": { + "psr-0": { + "SensioLabs\\Security": "" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Fabien Potencier", + "email": "fabien.potencier@gmail.com" + } + ], + "description": "A security checker for your composer.lock", + "time": "2015-11-07 08:07:40" + }, { "name": "spatie/laravel-glide", "version": "3.0.1",