How to use the command security-checker (with examples)

The security-checker command is a useful tool for PHP developers to check if their application’s dependencies have any known security vulnerabilities. It utilizes the composer.lock file to identify any potential security issues and provides the results for further analysis. In this article, we will explore different use cases of the security-checker command.

Use case 1: Look for security issues in the project dependencies

Code:

security-checker security:check

Motivation: By executing this command, you can perform a security check on your project dependencies. It examines the composer.lock file in the current directory and alerts you if any of the dependencies have known security vulnerabilities. Regularly checking for security issues helps ensure the overall security of your PHP application.

Explanation:

• security-checker is the command itself.
• security:check is the command argument that triggers the security check on the project dependencies.

Example output:

Checking /path/to/your/composer.lock
No security vulnerabilities found.

Use case 2: Use a specific composer.lock file

Code:

security-checker security:check path/to/composer.lock

Motivation: Sometimes, you may need to analyze a specific composer.lock file from a different directory or of a different project. This use case allows you to specify the exact path to the composer.lock file and perform the security check accordingly.

Explanation:

• security-checker is the command itself.
• security:check is the command argument that performs the security check.
• path/to/composer.lock is the argument that specifies the path to the composer.lock file you want to analyze.

Example output:

Checking path/to/composer.lock
1 package has known vulnerabilities:
- symfony/symfony (2.8.32)
    - [CVE-2021-21324] Possible attack vectors exist in the PHP ServerMonitor Symfony bundle <= 3.11.0.

Use case 3: Return results as a JSON object

Code:

security-checker security:check --format=json

Motivation: If you need to process the security check results programmatically or integrate them with another tool or service, receiving the output in a structured format like JSON can be beneficial. This use case enables you to retrieve the results as a JSON object.

Explanation:

• security-checker is the command itself.
• security:check is the command argument that triggers the security check.
• --format=json is an option that specifies the output format as JSON.

Example output:

{
    "lock_path": "/path/to/your/composer.lock",
    "vulnerabilities": []
}

Conclusion

The security-checker command offers a straightforward way to identify known security vulnerabilities in your PHP application’s dependencies. By leveraging the various use cases described above, you can easily incorporate security checks into your development workflow and ensure that your project remains secure.