diff options
| author | Lukas Reschke <lukas@statuscode.ch> | 2020-11-20 14:19:59 +0300 |
|---|---|---|
| committer | Morris Jobke <hey@morrisjobke.de> | 2020-11-21 01:12:00 +0300 |
| commit | 47ac8e0028d88f3f103412df1574eb8212d57765 (patch) | |
| tree | 2523d7de0fd78007244faabfa991d30662fa7e8c /.github | |
| parent | 7fd7601016ca08cfcb5ad7281310d9272de61509 (diff) | |
Add Psalm Taint Flow Analysis
This adds the Psalm Security Analysis, as described at
https://psalm.dev/docs/security_analysis/
It also adds a plugin for adding input into AppFramework.
The results can be viewed in the GitHub Security tab at
https://github.com/nextcloud/server/security/code-scanning
**Q&A:**
Q: Why do you not use the shipped Psalm version?
A: I do a lot of changes to the Psalm Taint behaviour. Using released
versions is not gonna get us the results we want.
Q: How do I improve false positives?
A: https://psalm.dev/docs/security_analysis/avoiding_false_positives/
Q: How do I add custom sources?
A: https://psalm.dev/docs/security_analysis/custom_taint_sources/
Q: We should run this on apps!
A: Yes.
Q: What will change in Psalm?
A: Quite some of the PHP core functions are not yet marked to propagate
the taint. This leads to results where the taint flow is lost. That's
something that I am currently working on.
Q: Why is the plugin MIT licensed?
A: Because its the first of its kind (based on GitHub Code Search) and
I want other people to copy it if they want to. Security is for all :)
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
Diffstat (limited to '.github')
| -rw-r--r-- | .github/workflows/psalm-security.yml | 26 |
1 files changed, 26 insertions, 0 deletions
diff --git a/.github/workflows/psalm-security.yml b/.github/workflows/psalm-security.yml new file mode 100644 index 00000000000..0e19cda2d33 --- /dev/null +++ b/.github/workflows/psalm-security.yml @@ -0,0 +1,26 @@ +name: Psalm Security Analysis + +on: + push: + pull_request: + schedule: + - cron: '0 0 * * 0' + +jobs: + psalm: + name: Psalm + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v2 + with: + submodules: recursive + - name: Psalm + uses: docker://vimeo/psalm-github-actions + with: + security_analysis: true + report_file: results.sarif + - name: Upload Security Analysis results to GitHub + uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: results.sarif |