FriendsOfPHP/security-advisories

propel: 2.0.0-alpha11

DawoudIO opened this issue · 11 comments

thirdender commented

It looks to me like the security-advisory lists the correct versions, but the tool you're using doesn't understand the "-alphaX" portion of the version string. I think an issue needs to be raised for the symfony/cli repo to address the tool that is parsing the version strings.

fabpot commented

We should not have entries for alpha versions IMHO.

  • 👍1
Ocramius commented

Propel alpha is sadly very widespreadly used, so it's probably stable software that is not declared as such.

IMO valid to notify users that they are running something harmful.

  • 👍4
fabpot commented

The whole code is now Open-Source at https://github.com/fabpot/local-php-security-checker (server + client code, so no more API calls). Feel free to submit a PR there to fix this bug.

  • 👍1
  • 🚀1
dereuromark commented

The false positive is still present though it seems - the source of the problem seems still to be that the tool cannot properly see the order of non trivial release versions, e.g. alpha, beta, RC:

2.0.0-alpha1 < 2.0.0-alpha11 < 2.0.0-alpha2

the tool thinks - which is incorrect.

thirdender commented

I think I'm in agreement with @fabpot that there should not be any alpha/beta/rc identifiers. The SemVer spec does not consider these pre-release tags when comparing versions. See https://interrupt.memfault.com/blog/release-versioning for a good write-up of SemVer. Ideally the Propel2 library should increment the patch version number and not the "alpha" number.

stof commented

@thirdender as this targets composer packages, it should support things that composer accepts.

  • 👍1
stof commented

semver definitely considers pre-release tags. But the official semver spec requires a . between the prerelease identifier (alpha) and the prerelease version (so 2.0.0-alpha.11).

thirdender commented

Hmm, the article and SemVer library I'm using are both wrong then. Thanks for digging that up, looks like I have some more research to do.

Ocramius commented

Related: Roave/SecurityAdvisoriesBuilder#98 - @slash3b worked quite a lot to add support for patch version modifiers, should you need inspiration.

  • ❤️1
stof commented

I opened fabpot/local-php-security-checker#9 on the checker project itself to track this, in case someone wants to contribute.