nextcloud

Tree: 064fa10ecf

Author	SHA1	Message	Date
Christoph Wurst	7559a4a97d	Pin Psalm version for security analysis The action will otherwise pull dev-master and this can break easily as we just experience. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	2 years ago
John Molakvoæ	162229dbff	Fix psalm action	3 years ago
Christoph Wurst	ab3424ad44	Add ext-zip as platform dependency Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Roeland Jago Douma	cc18213c98	Have psalm analysis directly on github Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	3 years ago
Roeland Jago Douma	08cae2ec44	Revert "Pin Psalm version to an older one"	3 years ago
Lukas Reschke	f1d2dcdaa5	Pin Psalm version to an older one Ref https://github.com/vimeo/psalm/issues/5144 Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	3 years ago
Lukas Reschke	47ac8e0028	Add Psalm Taint Flow Analysis This adds the Psalm Security Analysis, as described at https://psalm.dev/docs/security_analysis/ It also adds a plugin for adding input into AppFramework. The results can be viewed in the GitHub Security tab at https://github.com/nextcloud/server/security/code-scanning Q&A: Q: Why do you not use the shipped Psalm version? A: I do a lot of changes to the Psalm Taint behaviour. Using released versions is not gonna get us the results we want. Q: How do I improve false positives? A: https://psalm.dev/docs/security_analysis/avoiding_false_positives/ Q: How do I add custom sources? A: https://psalm.dev/docs/security_analysis/custom_taint_sources/ Q: We should run this on apps! A: Yes. Q: What will change in Psalm? A: Quite some of the PHP core functions are not yet marked to propagate the taint. This leads to results where the taint flow is lost. That's something that I am currently working on. Q: Why is the plugin MIT licensed? A: Because its the first of its kind (based on GitHub Code Search) and I want other people to copy it if they want to. Security is for all :) Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	3 years ago

4 Commits (064fa10ecfe4725398895a21ab8bafd171e2eadd)