Download the PHP package pierre-arthur/sf-doctor without Composer
On this page you can find all versions of the php package pierre-arthur/sf-doctor. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Table of contents
Download pierre-arthur/sf-doctor
More information about pierre-arthur/sf-doctor
Files in pierre-arthur/sf-doctor
Download pierre-arthur/sf-doctor
More information about pierre-arthur/sf-doctor
Files in pierre-arthur/sf-doctor
Vendor pierre-arthur
Package sf-doctor
Short Description Automated audit tool for Symfony projects
License MIT
Package sf-doctor
Short Description Automated audit tool for Symfony projects
License MIT
FAQ
After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.
Example:
Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories.
In this case some credentials are needed to access such packages.
Please use the auth.json textarea to insert credentials, if a package is coming from a private repository.
You can look here for more information.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?
Informations about the package sf-doctor
SF-Doctor
Outil CLI d'audit automatise pour projets Symfony — 80+ checks, 11 modules, zero config.
SF-Doctor analyse la securite, l'architecture, la performance et la configuration de vos projets Symfony. Il detecte les failles, les anti-patterns et les oublis de configuration. Un rapport clair avec des recommandations concretes, du code de correction, et une estimation du temps de remediation — directement dans votre terminal, en JSON, PDF ou SARIF pour GitHub Code Scanning.
Ce que SF-Doctor detecte
Module Security (16 analyzers)
| Analyzer | Cible | Exemples de detection |
|---|---|---|
| FirewallAnalyzer | security.yaml |
Firewalls sans authenticator, sans access_control, mode lazy |
| AccessControlAnalyzer | security.yaml |
Roles manquants, roles deprecies, catch-all mal place, chemins sensibles non proteges |
| CsrfAnalyzer | framework.yaml, src/Form/ |
CSRF desactive globalement ou par FormType |
| SecretsAnalyzer | .env, .env.prod |
APP_SECRET absent, valeur par defaut, trop court |
| SensitiveDataAnalyzer | src/Entity/, src/Form/ |
Champs password/token exposes sans #[Ignore] |
| RememberMeAnalyzer | security.yaml |
Cookie sans secure, sans httponly, lifetime excessif |
| SymfonyVersionAnalyzer | composer.lock |
Version avec CVE connu, end-of-life, mineure non a jour |
| CorsAnalyzer | nelmio_cors.yaml |
allow_origin: ['*'] avec credentials, CORS manquant sur /api |
| HttpsAnalyzer | security.yaml |
Absence de requires_channel: https, cookies non securises, HSTS manquant |
| HttpMethodOverrideAnalyzer | framework.yaml |
HTTP verb tunneling sans protection CSRF |
| MassAssignmentAnalyzer | src/Form/ |
$form->submit($request->request->all()) sans liste blanche |
| RateLimiterAnalyzer | framework.yaml |
Route de login sans rate limiter (brute force) |
| BundleRouteExposureAnalyzer | Routes | Routes de bundles tiers exposees en production |
| ExposedDebugEndpointsAnalyzer | Routes | Endpoints de debug accessibles en prod |
| PublicSensitiveFilesAnalyzer | public/ |
Fichiers sensibles accessibles (.env, .git, etc.) |
| SequentialIdAnalyzer | src/Entity/ |
IDs sequentiels previsibles sur des ressources sensibles |
Module Architecture (7 analyzers)
| Analyzer | Cible | Exemples de detection |
|---|---|---|
| ControllerAnalyzer | src/Controller/ |
QueryBuilder/DQL dans les controllers, acces direct EntityManager |
| ServiceInjectionAnalyzer | src/ |
Injection de ContainerInterface, appels $this->container->get() |
| HeavyConstructorAnalyzer | src/Service/, src/Repository/ |
Appels BDD dans les constructeurs, >8 dependances injectees |
| VoterUsageAnalyzer | src/Controller/ |
Checks de roles manuels au lieu de Voters |
| PublicServiceAnalyzer | config/services.yaml |
Services declares public: true inutilement |
| EventSubscriberAnalyzer | src/EventSubscriber/ |
Logique metier lourde dans les subscribers, couplage EntityManager |
| InterLayerCoherenceAnalyzer | src/ |
Incoherences entre couches (controller, service, repository) |
Module Configuration (5 analyzers)
| Analyzer | Cible | Exemples de detection |
|---|---|---|
| DebugModeAnalyzer | .env.prod, .env |
APP_ENV != prod, APP_DEBUG=true en production |
| ProfilerAnalyzer | packages/ |
Profiler/toolbar actif en production |
| MailerAnalyzer | .env, mailer.yaml |
DSN null://null en prod (emails perdus) |
| HttpHeadersAnalyzer | Config | X-Frame-Options, X-Content-Type-Options, CSP manquants |
| ProductionReadinessAnalyzer | .env.prod, php.ini |
opcache timestamps, preload absent, composer.lock non commite |
Module Performance (1 analyzer)
| Analyzer | Cible | Exemples de detection |
|---|---|---|
| NplusOneAnalyzer | templates/ |
Acces a deux niveaux dans les boucles Twig (N+1 potentiel) |
Module Doctrine (5 analyzers)
| Analyzer | Cible | Exemples de detection |
|---|---|---|
| EagerLoadingAnalyzer | src/Entity/ |
fetch: EAGER sur OneToMany/ManyToMany |
| MissingIndexAnalyzer | src/Entity/, src/Repository/ |
Colonnes filtrees sans #[ORM\Index] |
| CascadeRiskAnalyzer | src/Entity/ |
cascade: ['all'], remove sans orphanRemoval |
| RepositoryPatternAnalyzer | src/ |
QueryBuilder hors des repositories |
| LazyGhostObjectAnalyzer | doctrine.yaml |
lazy_ghost_objects sur Doctrine ORM < 3.0 |
Module Messenger (4 analyzers)
| Analyzer | Cible | Exemples de detection |
|---|---|---|
| UnhandledMessageAnalyzer | src/Message/ |
Messages sans handler (silencieusement ignores) |
| UnserializableMessageAnalyzer | src/Message/ |
Closures ou resources dans les messages |
| MessengerTransportAnalyzer | messenger.yaml |
Transport sync, transport failed absent, retry manquant |
| MessengerSigningAnalyzer | messenger.yaml |
Messages non signes (Symfony 7.4+) |
Module API Platform (18 analyzers)
| Analyzer | Cible | Exemples de detection |
|---|---|---|
| OperationSecurityAnalyzer | src/Entity/, src/ApiResource/ |
Operations sans security, heritage de securite |
| SerializationGroupAnalyzer | src/Entity/, src/ApiResource/ |
Ressources sans groupes de serialisation |
| PaginationAnalyzer | api_platform.yaml |
Pagination desactivee, client_items_per_page sans maximum (DOS) |
| ValidationAnalyzer | src/Entity/, src/ApiResource/ |
Ressources sans #[Assert\*], colonnes NOT NULL sans NotBlank |
| DtoPatternAnalyzer | src/Entity/ |
Entites Doctrine exposees sans DTO (input/output) |
| FilterConfigAnalyzer | src/Entity/, src/ApiResource/ |
Filtres partial sur champs sensibles, OrderFilter sans restriction |
| DeprecatedAnnotationAnalyzer | src/Entity/, src/ApiResource/ |
Annotations 2.x (@ApiResource, @ApiSubresource) |
| SubresourceSecurityAnalyzer | src/Entity/, src/ApiResource/ |
Sous-ressources sans security (IDOR), imbrication profonde |
| OpenApiConfigAnalyzer | src/Entity/, src/ApiResource/ |
Ressources et operations sans description OpenAPI |
| NormalizationContextAnalyzer | src/Entity/, src/ApiResource/ |
normalizationContext sans denormalizationContext, groupes identiques read/write, groupes orphelins |
| ApiPropertyConfigAnalyzer | src/Entity/, src/ApiResource/ |
IDs auto-increment exposes (IDOR), identifiants modifiables |
| GlobalApiPlatformConfigAnalyzer | api_platform.yaml |
show_webby actif, error_formats absent, format HTML, mapping.paths |
| StateProviderProcessorAnalyzer | src/Entity/, src/ApiResource/ |
processor/provider referancant une classe inexistante (500 runtime), processor sur ressource read-only |
| HttpCacheAnalyzer | src/Entity/, src/ApiResource/ |
Absence de cache HTTP sur GET, cache public sur ressource protegee (fuite de donnees) |
| RateLimitingAnalyzer | src/Entity/, src/ApiResource/ |
Endpoints sensibles (login, register) sans throttling, POST publics sans rate limit |
| CircularReferenceAnalyzer | src/Entity/, src/ApiResource/ |
Relations bidirectionnelles sans #[MaxDepth], MaxDepth sans enable_max_depth |
| ResourceNamingAnalyzer | src/Entity/, src/ApiResource/ |
shortName non kebab-case, verbes dans les noms de ressources, routePrefix avec underscores |
| DeprecatedConfigKeyAnalyzer | api_platform.yaml |
Cles YAML depreciees (collection, item_operations, exception_to_status), Swagger 2, docs en production |
Module Twig (3 analyzers)
| Analyzer | Cible | Exemples de detection |
|---|---|---|
| TwigRawFilterAnalyzer | templates/ |
Filtre \|raw (risque XSS) |
| TwigSrcdocAnalyzer | templates/ |
Attribut srcdoc sans echappement |
| BusinessLogicInTwigAnalyzer | templates/ |
Logique metier dans les templates |
Module Deployment (4 analyzers)
| Analyzer | Cible | Exemples de detection |
|---|---|---|
| MigrationStatusAnalyzer | src/Migrations/ |
Migrations non executees |
| RequiredEnvVarsAnalyzer | .env |
Variables d'environnement requises manquantes |
| AssetsAnalyzer | public/ |
Assets non compiles ou obsoletes |
| LogAnalyzer | monolog.yaml |
Level debug en prod, absence de rotation |
Module Migration (3 analyzers)
| Analyzer | Cible | Exemples de detection |
|---|---|---|
| DeprecationUsageAnalyzer | src/ |
Usages de code deprecie |
| BundleDependencyAnalyzer | composer.json |
Bundles abandonnes ou incompatibles |
| PhpVersionAnalyzer | composer.json |
Version PHP non supportee |
Module Tests (3 analyzers)
| Analyzer | Cible | Exemples de detection |
|---|---|---|
| TestCoverageAnalyzer | tests/ |
Couverture insuffisante |
| SecurityTestAnalyzer | tests/ |
Tests de securite manquants pour les routes protegees |
| TestFixtureAnalyzer | tests/ |
Fixtures absentes ou mal structurees |
Prerequis
- PHP 8.2 ou superieur
- Un projet Symfony 6.4 ou 7.x
Installation
Utilisation
En tant que bundle Symfony (recommande)
Si votre projet utilise Symfony Flex, le bundle est enregistre automatiquement.
Sinon, ajoutez-le dans config/bundles.php :
Commandes disponibles
sf-doctor:audit — Audit standard
sf-doctor:full-audit — Rapport complet avec dette technique
sf-doctor:fix — Corrections interactives
sf-doctor:install-hooks — Hook pre-commit Git
En mode standalone (sans bundle)
SF-Doctor peut aussi fonctionner en dehors d'un projet Symfony :
Integration CI/CD
GitHub Action officielle
L'action GitHub upload automatiquement le rapport SARIF vers GitHub Code Scanning, ce qui affiche les issues directement dans l'onglet "Security" du repository.
Inputs disponibles :
| Input | Default | Description |
|---|---|---|
format |
sarif |
Format de sortie (console, json, sarif) |
modules |
--all |
Modules a auditer |
fail-on-critical |
true |
Echoue si des issues CRITICAL |
upload-sarif |
true |
Upload vers GitHub Code Scanning |
php-version |
8.3 |
Version PHP |
baseline |
Chemin baseline pour mode diff |
Integration manuelle
Exemple de sortie console
Exemple de sortie JSON
Features
Auto-detection du contexte
SF-Doctor detecte automatiquement les composants installes (Doctrine, Messenger, API Platform,
Twig, etc.) via composer.json et composer.lock. Seuls les analyzers pertinents sont
executes — zero configuration necessaire.
Score multi-dimensions
Le ScoreEngine calcule un score par dimension (securite, architecture, performance, doctrine,
messenger, etc.) avec des poids differencies. Chaque issue deduit des points selon sa severite :
| Severite | Penalite |
|---|---|
| CRITICAL | -10 points |
| WARNING | -3 points |
| SUGGESTION | -1 point |
Dette technique
Le TechnicalDebtCalculator estime le temps de remediation en heures et le cout financier
selon un TJM configurable. Utilisable via sf-doctor:full-audit --tjm=600.
Mode diff et baseline
Sauvegardez une baseline et comparez les analyses suivantes pour ne voir que les regressions :
Mode watch
Surveillez vos fichiers en temps reel pendant le developpement :
SF-Doctor surveille src/, config/ et templates/, et relance l'audit a chaque modification.
Cache
Les resultats sont mis en cache par hash SHA256 des fichiers de configuration. Si rien n'a change, l'audit est instantane.
Events
SF-Doctor dispatche des events Symfony a chaque etape de l'analyse :
AnalysisStartedEventIssueFoundEventModuleCompletedEventAnalysisCompletedEvent
Workflow
Le cycle de vie de l'analyse suit une state machine Symfony :
pending → running → completed / failed
Architecture
SF-Doctor est concu comme un bundle Symfony extensible. Chaque verification est un
Analyzer independant qui implemente AnalyzerInterface.
Creer un analyzer custom
Implementez AnalyzerInterface et le tag sf_doctor.analyzer est ajoute automatiquement
via autoconfigure :
Aucune configuration supplementaire necessaire. SF-Doctor detecte et execute automatiquement
tous les services qui implementent AnalyzerInterface.
Configuration du bundle
SF-Doctor est configurable via config/packages/sf_doctor.yaml :
Tests
Licence
MIT. Voir le fichier LICENSE.
All versions of sf-doctor with dependencies
PHP Build Version
Package Version
Requires
php Version
>=8.2
symfony/console Version ^6.4 || ^7.0
symfony/yaml Version ^6.4 || ^7.0
symfony/finder Version ^6.4 || ^7.0
symfony/dependency-injection Version ^6.4 || ^7.0
symfony/http-kernel Version ^6.4 || ^7.0
symfony/config Version ^6.4 || ^7.0
dompdf/dompdf Version ^3.1
symfony/serializer Version ^6.4 || ^7.0
symfony/property-access Version ^6.4 || ^7.0
symfony/workflow Version ^6.4 || ^7.0
symfony/messenger Version ^6.4 || ^7.0
symfony/console Version ^6.4 || ^7.0
symfony/yaml Version ^6.4 || ^7.0
symfony/finder Version ^6.4 || ^7.0
symfony/dependency-injection Version ^6.4 || ^7.0
symfony/http-kernel Version ^6.4 || ^7.0
symfony/config Version ^6.4 || ^7.0
dompdf/dompdf Version ^3.1
symfony/serializer Version ^6.4 || ^7.0
symfony/property-access Version ^6.4 || ^7.0
symfony/workflow Version ^6.4 || ^7.0
symfony/messenger Version ^6.4 || ^7.0
The package pierre-arthur/sf-doctor contains the following files
Loading the files please wait ...