Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f85f82d

Browse files
SeldaekSeldaek
authored
Merge pull request #12627 from Seldaek/audit_fix
Fix ignoring of CVE ids in security blocking
2 parents bfc0e31 + 59eb8e7 commit f85f82d

File tree

8 files changed

+218
-28
lines changed

8 files changed

+218
-28
lines changed

‎composer.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@
4343
"symfony/polyfill-php73": "^1.24",
4444
"symfony/polyfill-php80": "^1.24",
4545
"symfony/polyfill-php81": "^1.24",
46+
"symfony/polyfill-php84": "^1.30",
4647
"seld/signal-handler": "^2.0"
4748
},
4849
"require-dev": {

‎composer.lock‎

Lines changed: 89 additions & 9 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/Composer/Advisory/Auditor.php‎

Lines changed: 42 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ public function audit(IOInterface $io, RepositorySet $repoSet, array $packages,
8080

8181
// we need the CVE & remote IDs set to filter ignores correctly so if we have any matches using the optimized codepath above
8282
// and ignores are set then we need to query again the full data to make sure it can be filtered
83-
if (count($allAdvisories) > 0 && $ignoreList !== [] && $format === self::FORMAT_SUMMARY) {
83+
if ($format === self::FORMAT_SUMMARY && $this->needsCompleteAdvisoryLoad($allAdvisories, $ignoreList)) {
8484
$result = $repoSet->getMatchingSecurityAdvisories($packages, false, $ignoreUnreachable);
8585
$allAdvisories = $result['advisories'];
8686
$unreachableRepos = array_merge($unreachableRepos, $result['unreachableRepos']);
@@ -157,6 +157,35 @@ public function audit(IOInterface $io, RepositorySet $repoSet, array $packages,
157157
return $auditBitmask;
158158
}
159159

160+
/**
161+
* @param array<string, array<SecurityAdvisory|PartialSecurityAdvisory>> $advisories
162+
* @param array<string, string>|array<string> $ignoreList
163+
* @return bool
164+
*/
165+
public function needsCompleteAdvisoryLoad(array $advisories, array $ignoreList): bool
166+
{
167+
if (\count($advisories) === 0) {
168+
return false;
169+
}
170+
171+
// no partial advisories present
172+
if (array_all($advisories, static function (array $pkgAdvisories) {
173+
return array_all($pkgAdvisories, static function ($advisory) { return $advisory instanceof SecurityAdvisory; });
174+
})) {
175+
return false;
176+
}
177+
178+
if (\count($ignoreList) > 0 && !\array_is_list($ignoreList)) {
179+
$ignoredIds = array_keys($ignoreList);
180+
} else {
181+
$ignoredIds = $ignoreList;
182+
}
183+
184+
return array_any($ignoredIds, static function ($id) {
185+
return !str_starts_with($id, 'PKSA-');
186+
});
187+
}
188+
160189
/**
161190
* @param array<PackageInterface> $packages
162191
* @param string[]|array<string, string> $ignoreAbandoned
@@ -304,6 +333,7 @@ private function outputAdvisoriesTable(ConsoleIO $io, array $advisories): void
304333
$headers = [
305334
'Package',
306335
'Severity',
336+
'Advisory ID',
307337
'CVE',
308338
'Title',
309339
'URL',
@@ -313,16 +343,13 @@ private function outputAdvisoriesTable(ConsoleIO $io, array $advisories): void
313343
$row = [
314344
$advisory->packageName,
315345
$this->getSeverity($advisory),
346+
$this->getAdvisoryId($advisory),
316347
$this->getCVE($advisory),
317348
$advisory->title,
318349
$this->getURL($advisory),
319350
$advisory->affectedVersions->getPrettyString(),
320351
$advisory->reportedAt->format(DATE_ATOM),
321352
];
322-
if ($advisory->cve === null) {
323-
$headers[] = 'Advisory ID';
324-
$row[] = $advisory->advisoryId;
325-
}
326353
if ($advisory instanceof IgnoredSecurityAdvisory) {
327354
$headers[] = 'Ignore reason';
328355
$row[] = $advisory->ignoreReason ?? 'None specified';
@@ -352,10 +379,8 @@ private function outputAdvisoriesPlain(IOInterface $io, array $advisories): void
352379
}
353380
$error[] = "Package: ".$advisory->packageName;
354381
$error[] = "Severity: ".$this->getSeverity($advisory);
382+
$error[] = "Advisory ID: ".$this->getAdvisoryId($advisory);
355383
$error[] = "CVE: ".$this->getCVE($advisory);
356-
if ($advisory->cve === null) {
357-
$error[] = "Advisory ID: ".$advisory->advisoryId;
358-
}
359384
$error[] = "Title: ".OutputFormatter::escape($advisory->title);
360385
$error[] = "URL: ".$this->getURL($advisory);
361386
$error[] = "Affected versions: ".OutputFormatter::escape($advisory->affectedVersions->getPrettyString());
@@ -425,6 +450,15 @@ private function getSeverity(SecurityAdvisory $advisory): string
425450
return $advisory->severity;
426451
}
427452

453+
private function getAdvisoryId(SecurityAdvisory $advisory): string
454+
{
455+
if (str_starts_with($advisory->advisoryId, 'PKSA-')) {
456+
return '<href=https://packagist.org/security-advisories/'.$advisory->advisoryId.'>'.$advisory->advisoryId.'</>';
457+
}
458+
459+
return $advisory->advisoryId;
460+
}
461+
428462
private function getCVE(SecurityAdvisory $advisory): string
429463
{
430464
if ($advisory->cve === null) {

‎src/Composer/Compiler.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,8 @@ public function compile(string $pharFile = 'composer.phar'): void
196196
'vendor/symfony/polyfill-mbstring/bootstrap80.php',
197197
'vendor/symfony/polyfill-php73/Resources/stubs/JsonException.php',
198198
'vendor/symfony/service-contracts/Attribute/SubscribedService.php',
199+
'vendor/symfony/polyfill-php84/Resources/stubs/Deprecated.php',
200+
'vendor/symfony/polyfill-php84/bootstrap82.php',
199201
]);
200202
}
201203

‎src/Composer/DependencyResolver/SecurityAdvisoryPoolFilter.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,11 @@ public function filter(Pool $pool, array $repositories): Pool
6262
}
6363
}
6464

65-
$allAdvisories = $repoSet->getMatchingSecurityAdvisories($packagesForAdvisories, true);
65+
$allAdvisories = $repoSet->getMatchingSecurityAdvisories($packagesForAdvisories, true, true);
66+
if ($this->auditor->needsCompleteAdvisoryLoad($allAdvisories['advisories'], $this->auditConfig->ignoreListForBlocking)) {
67+
$allAdvisories = $repoSet->getMatchingSecurityAdvisories($packagesForAdvisories, false, true);
68+
}
69+
6670
$advisoryMap = $this->auditor->processAdvisories($allAdvisories['advisories'], $this->auditConfig->ignoreListForBlocking, $this->auditConfig->ignoreSeverityForBlocking)['advisories'];
6771

6872
$packages = [];

0 commit comments

Comments
 (0)