PHP code example of vartroth / php-security-lint

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

vartroth / php-security-lint example snippets

use PhpSecurityLint\SecurityLinter;

$linter = new SecurityLinter();

// Set custom exclude patterns
$linter->setExcludePatterns(['*/vendor/*', '*/cache/*']);

// Enable strict mode
$linter->setStrictMode(true);

// Add custom insecure function
$linter->addInsecureFunction('my_debug_function', 'Custom debug function');

// Lint a directory
$result = $linter->lint('/path/to/project');

// Check results
if ($result->hasIssues()) {
    foreach ($result->getViolations() as $violation) {
        echo $violation->getMessage() . "\n";
    }
}

// security-lint-config.php

return [
    'exclude_patterns' => [
        '*/vendor/*',
        '*/cache/*',
        '*/storage/logs/*',
    ],
    'custom_functions' => [
        'dd' => 'Laravel debug function - should not be used in production',
        'dump' => 'Symfony debug function - should not be used in production',
    ],
    'strict_mode' => false,
];

bash
composer global 

bash
# Scan a directory
./vendor/bin/php-security-lint /path/to/your/project

# Scan a single file
./vendor/bin/php-security-lint /path/to/file.php

bash
./vendor/bin/php-security-lint --exclude="*/cache/*" --exclude="*/temp/*" /path/to/project

+----------------+------+----------+----------+--------------------------------------------------+
| File           | Line | Function | Severity | Reason                                           |
+----------------+------+----------+----------+--------------------------------------------------+
| example.php    | 15   | var_dump | MEDIUM   | Debug function that should not be used in prod.. |
| another.php    | 23   | eval     | HIGH     | Code evaluation function - high security risk   |
+----------------+------+----------+----------+--------------------------------------------------+

Summary: 7 violations in 3 files

yaml
security-lint:
  image: php:8.1
  before_script:
    - curl -sS https://getcomposer.org/installer | php
    - php composer.phar install --no-dev
  script:
    - ./vendor/bin/php-security-lint --format=json --no-progress src/
  only:
    - merge_requests
    - master

bash
git clone https://github.com/vartroth/php-security-lint.git
cd php-security-lint
composer install