Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SDK-4093. Added Security update checker doc / checkers renamed #2072

Merged
merged 8 commits into from
Aug 8, 2023
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
---
title: Open-source vulnerabilities checker
description: Reference information for evaluator tools.
template: howto-guide-template
---

Open-source vulnerabilities checker is a tool that checks if your PHP application depends on PHP packages with known security vulnerabilities.

## Problem description

A project can sometimes use dependencies that contain known vulnerabilities.. To minimize the security risk for the project, such dependencies should be updated to the version that has the vulnerability fixed.

## Example of an evaluator error message

```bash
===================================
OPEN SOURCE VULNERABILITIES CHECKER
===================================

Message: Improper header validation (CVE-2023-29197): https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw
Target: guzzlehttp/psr7:2.4.1
```

## Example of code that causes an evaluator error

Your `composer.lock` file contains package versions that have security issues:

```bash
...
{
"name": "guzzlehttp/psr7",
"version": "2.4.1",
"source": {
"type": "git",
"url": "https://github.com/guzzle/psr7.git",
...
},
...
````

### Resolving the error

To resolve the error:
1. Upgrade the package to a version where the vulnerability issue is fixed.

This file was deleted.

Original file line number Diff line number Diff line change
@@ -1,24 +1,24 @@
---
title: Security checker
title: Spryker security checker
description: Reference information for evaluator tools.
template: howto-guide-template
---

Security Checker is a tool that checks if your PHP application depends on PHP packages with known security vulnerabilities.
Security Update Checker is a tool that checks if security fixes exist for Spryker modules that are present in your project.

## Problem description

A project can sometimes use dependencies that contain known vulnerabilities. To minimize the security risk for the project, such dependencies should be updated to the version that has the vulnerability fixed.
A project can sometimes use dependencies that contain known vulnerabilities. To minimize the security risk for the project, these dependencies should be updated to the version that has the vulnerability fixed.

## Example of an evaluator error message

```bash
================
SECURITY CHECKER
================
========================
SPRYKER SECURITY CHECKER
========================

Message: Improper header validation (CVE-2023-29197): https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw
Target: guzzlehttp/psr7:2.4.1
Message: Security update available for the module spryker/price-product-merchant-relationship-storage, actual version 1.14.0
Target: spryker/price-product-merchant-relationship-storage:1.15.0
```

## Example of code that causes an evaluator error
Expand All @@ -28,11 +28,11 @@ Your `composer.lock` file contains package versions that have security issues:
```bash
...
{
"name": "guzzlehttp/psr7",
"version": "2.4.1",
"name": "spryker/price-product-merchant-relationship-storage",
"version": "1.14.0",
"source": {
"type": "git",
"url": "https://github.com/guzzle/psr7.git",
"url": "https://github.com/spryker/price-product-merchant-relationship-storage.git",
...
},
...
Expand Down