Skip to content

Documented the security:check command #4651

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Jan 1, 2015
+53 −2
Merged

Documented the security:check command #4651

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
7f3fb71
Documented the security:check command
javiereguiluz Dec 14, 2014
36d3f2b
This command is available sin Symfony 2.5
javiereguiluz Dec 14, 2014
0e7d0cd
Added a note about the security advisories database
javiereguiluz Dec 14, 2014
e552369
Added a missing link reference
javiereguiluz Dec 14, 2014
3c9a962
Added a note about the security:check command
javiereguiluz Dec 16, 2014
fdfb1a0
Added a note about the SensioDistributionBundle necessary for securit…
javiereguiluz Dec 16, 2014
897dc70
Added a lot of changes suggested by reviewers
javiereguiluz Dec 30, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions book/installation.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,18 @@ them all at once:
Depending on the complexity of your project, this update process can take up to
several minutes to complete.

.. tip::

Symfony provides a command to check whether your project's dependencies
contain any know security vulnerability:

.. code-block:: bash

$ php app/console security:check

A good security practice is to execute this command regularly to be able to
update or replace compromised dependencies as soon as possible.

.. _installing-a-symfony2-distribution:

Installing a Symfony Distribution
Expand Down
23 changes: 23 additions & 0 deletions book/security.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2055,6 +2055,28 @@ to work correctly. Just pass a file name to enable it::
You can also access a secure random instance directly from the Symfony
dependency injection container; its name is ``security.secure_random``.

Checking Dependencies Security
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checking for Known Security Vulnerabilities in Dependencies


.. versionadded:: 2.5
The ``security:check`` command was introduced in Symfony 2.5. This command is
included in ``SensioDistributionBundle``, which has to be registered in your
application in order to use this command.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reference to the SensioDistributionBundle should probably also be added in the installation chapter.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you really think is necessary? The installation chapter is for people that know nothing about Symfony. They're going to use the installer and they're going to install the standard edition, so everything works out of the box. My feel is that this note is only for advanced users doing custom installations.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm, I guess you're right now that I think about it again.


When using lots of dependencies in your Symfony projects, odds are that some of
them contain security vulnerabilities. That's why Symfony includes a command
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"odds are" sounds like it's likely. Is it likely? Or can we soften the wording.

And I think it would be nice to actually say Composer or composer.json here to be absolutely clear what "dependencies" we're talking about.

called ``security:check`` that checks whether any of your installed dependencies
contain a known security vulnerability:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you should add a note that the command is provided by SensioDistributionBundle, so it will be available only when it is registered


.. code-block:: bash

$ php app/console security:check

A good security practice is to execute this command regularly to be able to
update or replace compromised dependencies as soon as possible. Internally,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we could add a hint, that the command is returning an error code if the security issue is found, so you could use it in a ci process. https://github.com/sensiolabs/security-checker/blob/master/SensioLabs/Security/Command/SecurityCheckerCommand.php#L98

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@timglabisch this hint looks to me too specific to be included, but let's see what do other reviewers think about it.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Advising to run the command on a regular basis imho calls for integration into build environments. :) We can simply add a tip after this paragraph like this:

.. tip::

    The ``security:check`` command terminates with a non-zero exit code if
    any of your dependencies is affected by a known security vulnerability.
    Therefore, you can easily integrate it in your build process.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

this command uses the public `security advisories database`_ published by the
FriendsOfPHP organization.

Final Words
-----------

Expand Down Expand Up @@ -2088,3 +2110,4 @@ Learn more from the Cookbook
.. _`FOSUserBundle`: https://github.com/FriendsOfSymfony/FOSUserBundle
.. _`implement the \Serializable interface`: http://php.net/manual/en/class.serializable.php
.. _`Timing attack`: http://en.wikipedia.org/wiki/Timing_attack
.. _`security advisories database`: https://github.com/FriendsOfPHP/security-advisories
12 changes: 10 additions & 2 deletions contributing/code/security.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,8 @@ confirmed, the core-team works on a solution following these steps:
#. Publish the post on the official Symfony `blog`_ (it must also be added to
the "`Security Advisories`_" category);
#. Update the security advisory list (see below).
#. Update the public `security advisories database`_ maintained by the
FriendsOfPHP organization and which is used by the ``security:check`` command.

.. note::

Expand Down Expand Up @@ -93,6 +95,11 @@ of the downstream projects included in this process:
Security Advisories
-------------------

.. tip::

You can check your Symfony application for known security vulnerabilities
using the ``security:check`` command.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we could link to the section you added to the "security" chapter

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've created the following link. Please tell me if the format is correct:

.. tip::

    You can check your Symfony application for known security vulnerabilities
    using the ``security:check`` command. See :doc:`</book/security/checking-vulnerabilities>`

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This won't work given that /book/security/checking-vulnerabilities.rst is no document. But book-security-checking-vulnerabilities is a label and you can use the ref directive instead:

[...] command (see :ref:`book-security-checking-vulnerabilities`).


This section indexes security vulnerabilities that were fixed in Symfony
releases, starting from Symfony 1.0.0:

Expand All @@ -119,6 +126,7 @@ releases, starting from Symfony 1.0.0:
* March 21, 2008: `symfony 1.0.12 is (finally) out ! <http://symfony.com/blog/symfony-1-0-12-is-finally-out>`_
* June 25, 2007: `symfony 1.0.5 released (security fix) <http://symfony.com/blog/symfony-1-0-5-released-security-fix>`_

.. _Git repository: https://github.com/symfony/symfony
.. _blog: http://symfony.com/blog/
.. _Git repository: https://github.com/symfony/symfony
.. _blog: http://symfony.com/blog/
.. _Security Advisories: http://symfony.com/blog/category/security-advisories
.. _`security advisories database`: https://github.com/FriendsOfPHP/security-advisories