Laravel Security Scanner Laravel Package

Getting Started

Minimal Steps

1. Installation

   composer require --dev laramint/laravel-security-scanner
   

   The package auto-discovers via composer/installed.json. For manual invocation:

   vendor/bin/php-security-scanner --extension=LaraMint\LaravelSecurityScanner\LaravelExtension
   

2. First Scan Run the scanner on your Laravel project root:

   vendor/bin/php-security-scanner .
   

   Focus on critical/high severity issues first (e.g., SQL injection, auth bypass).

3. Key Flags

   • Critical: laravel.sql-injection, laravel.unsafe-auth, laravel.artisan-call
   • High: laravel.mass-assignment, laravel.unsafe-validator, laravel.file-upload-validation

Implementation Patterns

Workflows

1. Pre-Commit Hook Integrate with Git hooks to scan before commits:

   echo 'vendor/bin/php-security-scanner .' >> .git/hooks/pre-commit
   chmod +x .git/hooks/pre-commit
   

   Tip: Use --severity=high,critical to avoid noise.

2. CI/CD Pipeline Add to Laravel CI (e.g., GitHub Actions):

   - name: Security Scan
     run: vendor/bin/php-security-scanner --severity=high,critical --extension=LaraMint\LaravelSecurityScanner\LaravelExtension .
   

   Fail the build on critical issues.

3. Targeted Scans

   • Routes: Scan routes/ for redirect()->to($tainted) or View::make($tainted).
   • Controllers: Focus on update(), store(), and Auth::loginUsingId().
   • Jobs/Commands: Check Artisan::call($tainted) or Process::run($tainted).

4. False Positive Handling Suppress known-safe patterns via .php-security-scanner.json:

   {
     "rules": {
       "laravel.sql-injection": {
         "paths": ["app/Helpers/SqlBuilder.php"]
       }
     }
   }
   

Integration Tips

• Laravel IDE Helpers: Use phpstan or psalm alongside the scanner for static analysis.
• Custom Rules: Extend AbstractRule for project-specific checks (e.g., internal API endpoints).
• Taint Tracking: Leverage Laravel’s request() methods (e.g., $request->input('user_id')) as taint sources in custom rules.

Gotchas and Tips

Pitfalls

1. Overly Broad Exceptions

   • Avoid suppressing laravel.sql-injection for entire files unless 100% sure of safety (e.g., ORM-generated raw queries).
   • Example: A whereRaw("CAST($value AS INT)") may still be unsafe if $value is tainted.

2. Blade False Positives

   • {!! $safeVar !!} triggers laravel.blade-raw-echo, but may be intentional (e.g., trusted HTML from a CMS).
   • Fix: Use {{ $var }} or explicitly mark as safe in custom rules.

3. Environment Leaks

   • env('APP_KEY') in Blade/views triggers laravel.env-leak even if cached.
   • Fix: Move sensitive env access to controllers/services.

4. Taint Propagation

   • The scanner assumes request()->input() is tainted, but intermediate processing (e.g., strtolower()) may not clear taint.
   • Tip: Use LaravelExtension::clearTaint() in custom rules for sanitized data.

5. Artisan/Process Commands

   • Artisan::call('migrate:fresh') is safe, but Artisan::call($userInput) is critical.
   • Gotcha: Laravel’s Process facade (v10+) also triggers laravel.process-shell.

Debugging

• Verbose Output: Use --verbose to see taint flow:

  vendor/bin/php-security-scanner --verbose .
  

• Rule Isolation: Test individual rules with:

  vendor/bin/php-security-scanner --rule=laravel.sql-injection .
  

• Taint Visualization: Add // @phpstan-ignore-next-line temporarily to trace taint sources.

Extension Points

1. Custom Taint Sources Override LaravelExtension::register() to add project-specific sources:

   $extension->addTaintSource('app()->make(\App\Services\UntrustedService::class)');
   

2. Severity Tuning Adjust default severities in config/php-security-scanner.php:

   'rules' => [
       'laravel.debug-code' => 'low', // Downgrade debug leaks
   ],
   

3. Dynamic Analysis Combine with phpstan for deeper static analysis:

   vendor/bin/phpstan analyse --level=max --generate-report=html
   

4. Performance Exclude vendor/ and node_modules/ from scans:

   vendor/bin/php-security-scanner --exclude=vendor,node_modules .