Skip to content

Commit 1b8a61d

Browse files
jmarciljmarcil
authored
Merge pull request #60 from jrfnl/feature/add-initial-ci-check
Add initial CI check
2 parents 493d5a1 + 7456379 commit 1b8a61d

File tree

5 files changed

+199
-123
lines changed

5 files changed

+199
-123
lines changed

‎.travis.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
dist: trusty
2+
3+
language: php
4+
5+
## Cache composer and apt downloads.
6+
cache:
7+
apt: true
8+
directories:
9+
# Cache directory for older Composer versions.
10+
- $HOME/.composer/cache/files
11+
# Cache directory for more recent Composer versions.
12+
- $HOME/.cache/composer/files
13+
14+
php:
15+
- 5.4
16+
- 7.4
17+
- "nightly"
18+
19+
# Define the stages used.
20+
stages:
21+
- name: sniff
22+
- name: test
23+
24+
jobs:
25+
fast_finish: true
26+
27+
include:
28+
#### SNIFF STAGE ####
29+
- stage: sniff
30+
php: 7.4
31+
addons:
32+
apt:
33+
packages:
34+
- libxml2-utils
35+
script:
36+
# Validate the composer.json file.
37+
# @link https://getcomposer.org/doc/03-cli.md#validate
38+
- composer validate --no-check-all --strict
39+
40+
# Validate the xml files.
41+
# @link http://xmlsoft.org/xmllint.html
42+
- xmllint --noout --schema ./vendor/squizlabs/php_codesniffer/phpcs.xsd ./Security/ruleset.xml
43+
- xmllint --noout --schema ./vendor/squizlabs/php_codesniffer/phpcs.xsd ./example_base_ruleset.xml
44+
- xmllint --noout --schema ./vendor/squizlabs/php_codesniffer/phpcs.xsd ./example_drupal7_ruleset.xml
45+
46+
# Check the code-style consistency of the xml files.
47+
- diff -B ./Security/ruleset.xml <(xmllint --format "./Security/ruleset.xml")
48+
- diff -B ./example_base_ruleset.xml <(xmllint --format "./example_base_ruleset.xml")
49+
- diff -B ./example_drupal7_ruleset.xml <(xmllint --format "./example_drupal7_ruleset.xml")
50+
51+
allow_failures:
52+
# Allow failures for unstable builds.
53+
- php: "nightly"
54+
55+
before_install:
56+
# Speed up build time by disabling Xdebug when its not needed.
57+
- phpenv config-rm xdebug.ini || echo 'No xdebug config.'
58+
59+
- export XMLLINT_INDENT=" "
60+
61+
# --prefer-dist will allow for optimal use of the travis caching ability.
62+
- composer install --prefer-dist --no-suggest
63+
64+
script:
65+
# Lint PHP files against parse errors.
66+
- composer lint

‎Security/ruleset.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
<?xml version="1.0"?>
2-
<ruleset name="Security" namespace="PHPCS_SecurityAudit\Security">
3-
<description>Security related coding standard.</description>
2+
<ruleset xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Security" namespace="PHPCS_SecurityAudit\Security" xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/squizlabs/PHP_CodeSniffer/master/phpcs.xsd">
3+
<description>Security related coding standard.</description>
44
</ruleset>

‎composer.json‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "pheromone/phpcs-security-audit",
3-
"type" : "phpcodesniffer-standard",
3+
"type" : "phpcodesniffer-standard",
44
"description": "phpcs-security-audit is a set of PHP_CodeSniffer rules that finds vulnerabilities and weaknesses related to security in PHP code",
55
"license": "GPL-3.0-or-later",
66
"authors": [
@@ -13,5 +13,16 @@
1313
"php": ">=5.4",
1414
"squizlabs/php_codesniffer": "^3.0.2",
1515
"dealerdirect/phpcodesniffer-composer-installer": "^0.4.1 || ^0.5 || ^0.6"
16+
},
17+
"require-dev" : {
18+
"php-parallel-lint/php-parallel-lint": "^1.0",
19+
"php-parallel-lint/php-console-highlighter": "^0.4"
20+
},
21+
"minimum-stability": "dev",
22+
"prefer-stable": true,
23+
"scripts" : {
24+
"lint": [
25+
"@php ./vendor/php-parallel-lint/php-parallel-lint/parallel-lint . -e php --exclude vendor --exclude .git"
26+
]
1627
}
1728
}

‎example_base_ruleset.xml‎

Lines changed: 49 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,52 @@
11
<?xml version="1.0"?>
2-
<ruleset name="PHPSecurity">
3-
<description>Rules for standard PHP projects</description>
4-
5-
<!-- Code Reviews Rules -->
6-
<!--
7-
<rule ref="Generic.CodeAnalysis.UnusedFunctionParameter"/>
8-
<rule ref="PEAR"/>
9-
-->
10-
11-
<!-- Security Code Reviews Rules -->
12-
13-
<!-- Global properties -->
14-
<!-- Please note that not every sniff uses them and they can be overwritten by rule -->
15-
<!-- Paranoia mode: Will generate more alerts but will miss less vulnerabilites. Good for assisting manual code review. -->
16-
<config name="ParanoiaMode" value="1"/>
17-
18-
<!-- BadFunctions -->
19-
<!-- PHP functions that can lead to security issues -->
20-
<rule ref="Security.BadFunctions.Asserts"/>
21-
<rule ref="Security.BadFunctions.Backticks"/>
22-
<rule ref="Security.BadFunctions.CallbackFunctions"/>
23-
<rule ref="Security.BadFunctions.CryptoFunctions"/>
24-
<rule ref="Security.BadFunctions.EasyRFI"/>
25-
<rule ref="Security.BadFunctions.EasyXSS">
26-
<properties>
27-
<!-- Comment out to follow global ParanoiaMode -->
28-
<property name="forceParanoia" value="1"/>
29-
</properties>
30-
</rule>
31-
<rule ref="Security.BadFunctions.ErrorHandling"/>
32-
<rule ref="Security.BadFunctions.FilesystemFunctions"/>
33-
<rule ref="Security.BadFunctions.FringeFunctions"/>
34-
<rule ref="Security.BadFunctions.FunctionHandlingFunctions"/>
35-
<rule ref="Security.BadFunctions.Mysqli"/>
36-
<rule ref="Security.BadFunctions.NoEvals"/>
37-
<rule ref="Security.BadFunctions.Phpinfos"/>
38-
<rule ref="Security.BadFunctions.PregReplace"/>
39-
<rule ref="Security.BadFunctions.SQLFunctions"/>
40-
<rule ref="Security.BadFunctions.SystemExecFunctions"/>
41-
42-
<!-- CVE -->
43-
<!-- Entries from CVE database from vendor PHP and bugs.php.net -->
44-
<rule ref="Security.CVE.CVE20132110"/>
45-
<rule ref="Security.CVE.CVE20134113"/>
46-
47-
<!-- Misc -->
48-
<rule ref="Security.Misc.BadCorsHeader"/>
49-
<rule ref="Security.Misc.IncludeMismatch"/>
50-
<rule ref="Security.Misc.TypeJuggle"/>
2+
<ruleset xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="PHPSecurity" xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/squizlabs/PHP_CodeSniffer/master/phpcs.xsd">
3+
<description>Rules for standard PHP projects</description>
4+
5+
<!-- Code Reviews Rules -->
6+
<!--
7+
<rule ref="Generic.CodeAnalysis.UnusedFunctionParameter"/>
8+
<rule ref="PEAR"/>
9+
-->
10+
11+
<!-- Security Code Reviews Rules -->
12+
13+
<!-- Global properties. -->
14+
<!-- Please note that not every sniff uses them and they can be overwritten per rule. -->
15+
<!-- Paranoia mode: Will generate more alerts but will miss less vulnerabilites. Good for assisting manual code review. -->
16+
<config name="ParanoiaMode" value="1"/>
17+
18+
<!-- BadFunctions -->
19+
<!-- PHP functions that can lead to security issues -->
20+
<rule ref="Security.BadFunctions.Asserts"/>
21+
<rule ref="Security.BadFunctions.Backticks"/>
22+
<rule ref="Security.BadFunctions.CallbackFunctions"/>
23+
<rule ref="Security.BadFunctions.CryptoFunctions"/>
24+
<rule ref="Security.BadFunctions.EasyRFI"/>
25+
<rule ref="Security.BadFunctions.EasyXSS">
26+
<properties>
27+
<!-- Comment out to follow global ParanoiaMode -->
28+
<property name="forceParanoia" value="1"/>
29+
</properties>
30+
</rule>
31+
<rule ref="Security.BadFunctions.ErrorHandling"/>
32+
<rule ref="Security.BadFunctions.FilesystemFunctions"/>
33+
<rule ref="Security.BadFunctions.FringeFunctions"/>
34+
<rule ref="Security.BadFunctions.FunctionHandlingFunctions"/>
35+
<rule ref="Security.BadFunctions.Mysqli"/>
36+
<rule ref="Security.BadFunctions.NoEvals"/>
37+
<rule ref="Security.BadFunctions.Phpinfos"/>
38+
<rule ref="Security.BadFunctions.PregReplace"/>
39+
<rule ref="Security.BadFunctions.SQLFunctions"/>
40+
<rule ref="Security.BadFunctions.SystemExecFunctions"/>
41+
42+
<!-- CVE -->
43+
<!-- Entries from CVE database from vendor PHP and bugs.php.net -->
44+
<rule ref="Security.CVE.CVE20132110"/>
45+
<rule ref="Security.CVE.CVE20134113"/>
46+
47+
<!-- Misc -->
48+
<rule ref="Security.Misc.BadCorsHeader"/>
49+
<rule ref="Security.Misc.IncludeMismatch"/>
50+
<rule ref="Security.Misc.TypeJuggle"/>
5151

5252
</ruleset>
53-

‎example_drupal7_ruleset.xml‎

Lines changed: 70 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -1,79 +1,79 @@
11
<?xml version="1.0"?>
2-
<ruleset name="Drupal7Security">
3-
<description>Rules for Drupal 7 projects</description>
4-
<!-- Code Reviews Rules -->
5-
<!--
6-
<rule ref="Generic.CodeAnalysis.UnusedFunctionParameter"/>
7-
<rule ref="PEAR"/>
8-
-->
2+
<ruleset xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Drupal7Security" xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/squizlabs/PHP_CodeSniffer/master/phpcs.xsd">
3+
<description>Rules for Drupal 7 projects</description>
94

10-
<!-- Security Code Reviews Rules -->
5+
<!-- Code Reviews Rules -->
6+
<!--
7+
<rule ref="Generic.CodeAnalysis.UnusedFunctionParameter"/>
8+
<rule ref="PEAR"/>
9+
-->
1110

12-
<!-- Global properties -->
13-
<!-- Please note that not every sniff uses them and they can be overwritten by rule -->
14-
<!-- Framework or CMS used. Must be a class under Security_Sniffs. -->
15-
<config name="CmsFramework" value="Drupal7"/>
16-
<!-- Paranoia mode: Will generate more alerts but will miss less vulnerabilites. Good for assisting manual code review. -->
17-
<config name="ParanoiaMode" value="1"/>
11+
<!-- Security Code Reviews Rules -->
1812

19-
<!-- BadFunctions -->
20-
<!-- PHP functions that can lead to security issues -->
21-
<rule ref="Security.BadFunctions.Asserts"/>
22-
<rule ref="Security.BadFunctions.Backticks"/>
23-
<rule ref="Security.BadFunctions.CallbackFunctions"/>
24-
<rule ref="Security.BadFunctions.CryptoFunctions"/>
25-
<rule ref="Security.BadFunctions.EasyRFI"/>
26-
<rule ref="Security.BadFunctions.EasyXSS"/>
27-
<rule ref="Security.BadFunctions.ErrorHandling"/>
28-
<rule ref="Security.BadFunctions.FilesystemFunctions"/>
29-
<rule ref="Security.BadFunctions.FringeFunctions"/>
30-
<rule ref="Security.BadFunctions.FunctionHandlingFunctions"/>
31-
<rule ref="Security.BadFunctions.Mysqli"/>
32-
<rule ref="Security.BadFunctions.NoEvals"/>
33-
<rule ref="Security.BadFunctions.Phpinfos"/>
34-
<rule ref="Security.BadFunctions.PregReplace"/>
35-
<rule ref="Security.BadFunctions.SQLFunctions"/>
36-
<rule ref="Security.BadFunctions.SystemExecFunctions"/>
13+
<!-- Global properties. -->
14+
<!-- Please note that not every sniff uses them and they can be overwritten per rule. -->
15+
<!-- Framework or CMS used. Must be a class under Security_Sniffs. -->
16+
<config name="CmsFramework" value="Drupal7"/>
17+
<!-- Paranoia mode: Will generate more alerts but will miss less vulnerabilites. Good for assisting manual code review. -->
18+
<config name="ParanoiaMode" value="1"/>
3719

38-
<!-- CVE -->
39-
<!-- Entries from CVE database from vendor PHP and bugs.php.net -->
40-
<rule ref="Security.CVE.CVE20132110"/>
41-
<rule ref="Security.CVE.CVE20134113"/>
20+
<!-- BadFunctions -->
21+
<!-- PHP functions that can lead to security issues -->
22+
<rule ref="Security.BadFunctions.Asserts"/>
23+
<rule ref="Security.BadFunctions.Backticks"/>
24+
<rule ref="Security.BadFunctions.CallbackFunctions"/>
25+
<rule ref="Security.BadFunctions.CryptoFunctions"/>
26+
<rule ref="Security.BadFunctions.EasyRFI"/>
27+
<rule ref="Security.BadFunctions.EasyXSS"/>
28+
<rule ref="Security.BadFunctions.ErrorHandling"/>
29+
<rule ref="Security.BadFunctions.FilesystemFunctions"/>
30+
<rule ref="Security.BadFunctions.FringeFunctions"/>
31+
<rule ref="Security.BadFunctions.FunctionHandlingFunctions"/>
32+
<rule ref="Security.BadFunctions.Mysqli"/>
33+
<rule ref="Security.BadFunctions.NoEvals"/>
34+
<rule ref="Security.BadFunctions.Phpinfos"/>
35+
<rule ref="Security.BadFunctions.PregReplace"/>
36+
<rule ref="Security.BadFunctions.SQLFunctions"/>
37+
<rule ref="Security.BadFunctions.SystemExecFunctions"/>
4238

43-
<!-- Misc -->
44-
<rule ref="Security.Misc.BadCorsHeader"/>
45-
<rule ref="Security.Misc.IncludeMismatch"/>
39+
<!-- CVE -->
40+
<!-- Entries from CVE database from vendor PHP and bugs.php.net. -->
41+
<rule ref="Security.CVE.CVE20132110"/>
42+
<rule ref="Security.CVE.CVE20134113"/>
4643

47-
<!-- Drupal7 -->
48-
<!-- Specific security issues of Drupal7 and advisories -->
49-
<rule ref="Security.Drupal7.AdvisoriesContrib">
50-
<exclude-pattern>(?&lt;!\.info)$</exclude-pattern>
51-
</rule>
52-
<rule ref="Security.Drupal7.AdvisoriesCore">
53-
<exclude-pattern>(?&lt;!includes\/bootstrap\.inc)$</exclude-pattern>
54-
</rule>
55-
<rule ref="Security.Drupal7.SQLi"/>
56-
<rule ref="Security.Drupal7.SQLi.D7NoDbQuery"/>
57-
<rule ref="Security.Drupal7.SQLi.D7DbQuerySQLi"/>
58-
<rule ref="Security.Drupal7.SQLi.D7DbQueryDirectVar"/>
59-
<rule ref="Security.Drupal7.XSSPTheme"/>
60-
<rule ref="Security.Drupal7.UserInputWatch">
61-
<properties>
62-
<property name="FormThreshold" value="10"/>
63-
<property name="FormStateThreshold" value="10"/>
64-
</properties>
65-
</rule>
66-
<rule ref="Security.Drupal7.XSSFormValue"/>
67-
<rule ref="Security.Drupal7.XSSHTMLConstruct"/>
68-
<rule ref="Security.Drupal7.DbQueryAC">
69-
<properties>
70-
<!-- Comment out to follow global ParanoiaMode -->
71-
<property name="forceParanoia" value="1"/>
72-
</properties>
73-
</rule>
74-
<rule ref="Security.Drupal7.DynQueries"/>
75-
<rule ref="Security.Drupal7.Cachei"/>
76-
<rule ref="Security.Drupal7.HttpRequest"/>
44+
<!-- Misc -->
45+
<rule ref="Security.Misc.BadCorsHeader"/>
46+
<rule ref="Security.Misc.IncludeMismatch"/>
7747

78-
</ruleset>
48+
<!-- Drupal 7 -->
49+
<!-- Specific security issues of Drupal7 and advisories. -->
50+
<rule ref="Security.Drupal7.AdvisoriesContrib">
51+
<exclude-pattern>(?&lt;!\.info)$</exclude-pattern>
52+
</rule>
53+
<rule ref="Security.Drupal7.AdvisoriesCore">
54+
<exclude-pattern>(?&lt;!includes\/bootstrap\.inc)$</exclude-pattern>
55+
</rule>
56+
<rule ref="Security.Drupal7.SQLi"/>
57+
<rule ref="Security.Drupal7.SQLi.D7NoDbQuery"/>
58+
<rule ref="Security.Drupal7.SQLi.D7DbQuerySQLi"/>
59+
<rule ref="Security.Drupal7.SQLi.D7DbQueryDirectVar"/>
60+
<rule ref="Security.Drupal7.XSSPTheme"/>
61+
<rule ref="Security.Drupal7.UserInputWatch">
62+
<properties>
63+
<property name="FormThreshold" value="10"/>
64+
<property name="FormStateThreshold" value="10"/>
65+
</properties>
66+
</rule>
67+
<rule ref="Security.Drupal7.XSSFormValue"/>
68+
<rule ref="Security.Drupal7.XSSHTMLConstruct"/>
69+
<rule ref="Security.Drupal7.DbQueryAC">
70+
<properties>
71+
<!-- Comment out to follow global ParanoiaMode -->
72+
<property name="forceParanoia" value="1"/>
73+
</properties>
74+
</rule>
75+
<rule ref="Security.Drupal7.DynQueries"/>
76+
<rule ref="Security.Drupal7.Cachei"/>
77+
<rule ref="Security.Drupal7.HttpRequest"/>
7978

79+
</ruleset>

0 commit comments

Comments
 (0)