How to Check for Known Security Vulnerabilities in Your Dependencies
How to Check for Known Security Vulnerabilities in Your Dependencies¶
When using lots of dependencies in your Symfony projects, some of them may
contain security vulnerabilities. That's why Symfony includes a command called
security:check that checks your
composer.lock file to find any known
security vulnerability in your installed dependencies:
$ php bin/console security:check
A good security practice is to execute this command regularly to be able to update or replace compromised dependencies as soon as possible. Internally, this command uses the public security advisories database published by the FriendsOfPHP organization.
security:check command terminates with a non-zero exit code if
any of your dependencies is affected by a known security vulnerability.
This way you can add it to your project build process and your continuous
integration workflows to make them fail when there are vulnerabilities.
To enable the
security:check command, make sure the
SensioDistributionBundle is installed and enabled in your application.
Make sure that the installed version of the security checker package is at
least 5.0 (run
composer show sensiolabs/security-checker to show it).
Older versions checked the security vulnerabilities using a URL that is no
longer available and the command execution will result in an error.
The security checker is also available as an independent console application and distributed as a PHAR file so you can use it in any PHP application. Check out the Security Checker repository for more details.
This work, including the code samples, is licensed under a Creative Commons BY-SA 3.0 license.