Php Security Scanner Laravel Package

Getting Started

Minimal Setup

1. Installation:

   composer require --dev laramint/php-security-scanner
   

   Add to composer.json under require-dev to ensure it runs only in development.

2. Basic Scan:

   vendor/bin/php-security-scanner scan src/
   

   • Default scans src/ directory recursively.
   • Outputs findings in CLI format (JSON/CSV via --format).

3. First Use Case: Integrate into CI/CD (e.g., GitHub Actions) to block merges with critical vulnerabilities:

   # .github/workflows/security.yml
   jobs:
     security-scan:
       runs-on: ubuntu-latest
       steps:
         - uses: actions/checkout@v4
         - run: composer install --dev
         - run: vendor/bin/php-security-scanner scan src/ --fail-on=critical
   

Implementation Patterns

Workflows

1. Pre-Commit Hooks: Use husky or pre-commit to run lightweight scans on staged files:

   vendor/bin/php-security-scanner scan --changed-files
   

   • Tip: Cache results to avoid full scans on every commit.

2. Custom Rulesets: Extend default rules via php-security-scanner.json:

   {
     "rules": {
       "Laravel.Eloquent.InsecureQuery": {
         "enabled": true,
         "severity": "high"
       }
     }
   }
   

3. Integration with Laravel:

   • Artisan Command: Create a custom command to wrap the scanner:

     // app/Console/Commands/SecurityScan.php
     public function handle() {
         $scanner = new \Laramint\SecurityScanner\Scanner();
         $results = $scanner->scan(base_path('app'));
         $this->output->table(['File', 'Issue', 'Severity'], $results);
     }
     

   • Service Provider: Register the scanner as a singleton for dynamic use:

     $this->app->singleton(SecurityScanner::class, function () {
         return new SecurityScanner(config('security-scanner.ruleset'));
     });
     

4. API-Driven Scans: Use the --json flag to parse results programmatically:

   $output = shell_exec('vendor/bin/php-security-scanner scan --json');
   $issues = json_decode($output, true);
   

Gotchas and Tips

Pitfalls

1. False Positives:

   • Issue: Overly strict regex for XSS (e.g., echo $_GET['input']).
   • Fix: Whitelist known-safe patterns in php-security-scanner.json:

     "whitelist": {
       "files": ["app/Helpers/SafeOutput.php"],
       "functions": ["app\\Helpers\\sanitizeOutput"]
     }
     

2. Performance:

   • Issue: Slow scans on large codebases.
   • Fix: Exclude vendor/, node_modules/, and test directories:

     vendor/bin/php-security-scanner scan --exclude="vendor|node_modules|tests"
     

3. Laravel-Specific Quirks:

   • Issue: False negatives for Blade templates (e.g., {!! $input !!}).
   • Fix: Add custom rules for Blade syntax:

     // app/Providers/AppServiceProvider.php
     public function boot() {
         \Laramint\SecurityScanner\Rules::addCustomRule(
             'Blade.XSS',
             '/\{\{\!\s*\$([^\}]+)\s*\}\}/',
             'Potential XSS in Blade: {{!! $variable !!}}'
         );
     }
     

4. Hardcoded Secrets:

   • Issue: Scanner may miss secrets in environment files (.env).
   • Fix: Use --secret-pattern to define custom patterns:

     vendor/bin/php-security-scanner scan --secret-pattern="DB_PASSWORD=.*"
     

Debugging

• Verbose Output: Use --verbose to debug rule matching:

  vendor/bin/php-security-scanner scan --verbose
  

• Dry Run: Test rules without modifying files:

  vendor/bin/php-security-scanner scan --dry-run
  

Extension Points

1. Custom Rules: Implement Laramint\SecurityScanner\RuleInterface for project-specific checks:

   class LaravelCsrfRule implements RuleInterface {
       public function matches(string $fileContent): bool {
           return str_contains($fileContent, "'_token' =>");
       }
       public function getSeverity(): string { return 'medium'; }
   }
   

2. Reporters: Extend Laramint\SecurityScanner\Reporter\AbstractReporter to format output (e.g., Slack alerts):

   class SlackReporter extends AbstractReporter {
       protected function formatIssue(Issue $issue): string {
           return "🚨 *$issue->getSeverity()* in $issue->getFile(): $issue->getMessage()";
       }
   }
   

3. Integration with Laravel Valet: Add to ~/.valet/Laravel/valet-secure.sh:

   #!/bin/bash
   cd "$1" && vendor/bin/php-security-scanner scan --fail-on=high