Download the PHP package jay-tank/idorguard without Composer
On this page you can find all versions of the php package jay-tank/idorguard. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download jay-tank/idorguard
More information about jay-tank/idorguard
Files in jay-tank/idorguard
Package idorguard
Short Description Static analyzer that flags Laravel controller actions receiving a route-model-bound Eloquent model with no visible authorization check in the method body.
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package idorguard
idorguard
Static analyzer for a specific, well-documented Laravel footgun: route
model binding without an authorization check. Laravel resolves a
{invoice} URL segment straight into an Invoice $invoice object before
your controller method body even runs. It is trivial to write a controller
action that receives that model and returns/mutates it without ever
checking that the current user is allowed to touch that particular
record — an IDOR (Insecure Direct Object Reference) that only surfaces when
someone changes the ID in the URL. Today this is caught by manual code
review or, more often, not at all until a security report comes in — there
is no dedicated static tool that checks for it; the closest existing
tooling (e.g. Laravel Ranger) does type resolution for route bindings, not
authorization coverage.
Quick start
Built on nikic/php-parser — the
same AST library used by PHPStan and Psalm.
Example
Add $this->authorize('view', $invoice); (or a Gate::/->can()/
abort_unless() check) and the finding disappears.
Exit code is 1 when findings exist, 0 otherwise — safe to drop straight
into CI.
Library API
v0.1 scope
- One rule: IDG001 — a public controller method (class name/parent
ending in
Controller) with a class-typed parameter that is not aRequest/Response/similar framework helper type (i.e. it looks like a route-model-bound Eloquent model), with no->authorize(),Gate::...,->can()/->cannot()/->allows()/->denies(), orabort_if()/abort_unless()call anywhere in the method body. - Presence-based, not control-flow-sensitive: any authorization-signal call anywhere in the method body suppresses the finding, even if it is on an unrelated branch — a deliberate false-negative-favoring choice to keep false positives near zero for v0.1.
- Not in scope yet: verifying the authorization check actually targets the
same model parameter, Form Request
authorize()methods, policy-class cross-referencing, non-Laravel frameworks.
See DETAILS.md for the full design, and docs/USAGE.md for the complete API/CLI reference.
Examples
See examples/ for a snippet with the bug and one handling it correctly.
License
MIT
