Claude/secure defaults ci linting e9h53#11
Merged
Conversation
- Add SECURE_DEFAULTS.md with comprehensive security checklist covering: - PHP configuration best practices - Input validation patterns with php-aegis Validator - Output sanitization with php-aegis Sanitizer - HTTP security headers configuration - Authentication, database, file, and crypto guidelines - CI/CD and dependency management practices - Add phpstan.neon with maximum strictness (level 9) - Enable all strict type checks - Check for implicit mixed types - Report maybes in method signatures - Add .php-cs-fixer.dist.php with PSR-12 and security rules - Enforce strict_types declaration - Enable strict comparisons - Warn on eval() usage - Migrate to secure random functions - Add php-lint.yml CI workflow with comprehensive checks: - PHP syntax validation - PHP-CS-Fixer code style enforcement - PHPStan level 9 static analysis - SPDX license header verification - strict_types declaration check - Security pattern detection (dangerous functions, weak crypto) - Composer dependency audit - PHP 8.1-8.4 compatibility matrix - Update .gitignore for PHP tooling cache files
OWASP Mapping: - Add detailed OWASP Top 10 2021 mapping section to SECURE_DEFAULTS.md - Document php-aegis coverage for each vulnerability category: - A01: Broken Access Control (Headers) - A02: Cryptographic Failures (Validator, Headers) - A03: Injection (Validator, Sanitizer, TurtleEscaper) - A05: Security Misconfiguration (Headers) - A10: SSRF (Validator) - Include code examples and checklists for each category - Add OWASP coverage summary matrix Test Suite: - Add ValidatorTest with 100+ test cases for: - Email, URL, HTTPS URL validation - IP address (v4, v6) validation - UUID, slug, domain, hostname validation - Null byte and safe filename checks - JSON, integer, semver, ISO 8601, hex color validation - Add SanitizerTest with XSS prevention tests: - HTML, attribute, JavaScript, CSS, URL escaping - Common XSS attack vector prevention - Null byte removal and filename sanitization - Add HeadersTest with security header validation: - Frame options, CSP, HSTS, referrer policy - Cross-origin policies (COEP, COOP, CORP) - Permissions policy configuration - Add TurtleEscaperTest for RDF injection prevention: - String and IRI escaping per W3C Turtle spec - Language tag validation (BCP 47) - Literal and triple building - Injection attack prevention CI Updates: - Add PHPUnit test job with xdebug coverage - Add coverage threshold checking (70% warning) - Add phpunit.xml configuration - Update workflow summary to include test results
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.