FriendsOfPHP/security-advisories

Would it be possible to add TYPO3 Extensions as well?

tomasnorre opened this issue · 8 comments

tomasnorre commented

I might overlook something, but would it be possible to add TYPO3 Extensions as well?
As I see it this only covers the TYPO3 Core, which of course is also important.

cc: @ohader

fabpot commented

This repository accepts all contributions, and makes no choices about which packages should be listed or not.

  • 👍1
tomasnorre commented

To understand you correct. I can make a PR that includes the TYPO3 Extension then?

fabpot commented

Yes, sure. This repository accepts PR for any Composer package, no restrictions.

ohader commented

@tomasnorre We should discuss that internally on our Slack #security channel, not via GitHub and please also not via Twitter.

@fabpot That information also was new to me. In a consequence that could mean that hundreds and thousands of advisories from other projects (Symfony, TYPO3, Joomla, Drupal, Wordpress, Yii2, ...) would be bundled in this repository... in the next consequence having a growth in https://github.com/Roave/SecurityAdvisories/blob/master/composer.json and potential impact on Composer actions, having to verify all version constraints.

Our (TYPO3 security team) idea would have been to keep vendor related advisories (just TYPO3 core in our case) in this repository and provide advisories for 3rd party plugins in a dedicated repository/platform, e.g. https://advisories.typo3.org (work-in-progress, not published yet).

  • 👍1
fabpot commented

This database is (at least for now) a hub for all security issues. I think it would make sense to consolidate everything here.

  • 👍1
fabpot commented

We do have entries for Symfony bundles for instance.

stof commented

@ohader conflict rules are not what makes composer update costly (at least not with an uptodate version of composer). These conflict rules are check only among packages which are already in the scope of the solver (as they can only reject a package from the solution, not include it in it).

  • 👍1
Ocramius commented

@fabpot That information also was new to me. In a consequence that could mean that hundreds and thousands of advisories from other projects (Symfony, TYPO3, Joomla, Drupal, Wordpress, Yii2, ...) would be bundled in this repository... in the next consequence having a growth in https://github.com/Roave/SecurityAdvisories/blob/master/composer.json and potential impact on Composer actions, having to verify all version constraints.

Not a big deal, as @stof has highlighted: exclusions ("conflict" section) are much cheaper than inclusion of ranges ("require")

  • 👍1