From 424356eff23bf5b39125f89d333236a2c54b0029 Mon Sep 17 00:00:00 2001 From: marklanser Date: Wed, 24 Dec 2025 10:11:58 +0100 Subject: [PATCH 1/4] Add intellij idea folder to gitignore --- .gitignore | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index fef750b..64a49a9 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ .phpunit.cache -/vendor \ No newline at end of file +/vendor +.idea \ No newline at end of file From f82a5ad3ec0dcc11e67765865e114567851a34c6 Mon Sep 17 00:00:00 2001 From: marklanser Date: Wed, 24 Dec 2025 10:41:17 +0100 Subject: [PATCH 2/4] Check actual installed packages for debug mode audit --- src/Services/Audits/DebugModeAuditService.php | 28 +++++++++++++++---- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/src/Services/Audits/DebugModeAuditService.php b/src/Services/Audits/DebugModeAuditService.php index 2cc953e..f76eb94 100644 --- a/src/Services/Audits/DebugModeAuditService.php +++ b/src/Services/Audits/DebugModeAuditService.php @@ -35,13 +35,10 @@ public function run(): bool // Check for development packages in composer.json $composerJson = $this->getComposerJson(); if ($composerJson) { - $installedPackages = array_merge( - array_keys($composerJson['require'] ?? []), - array_keys($composerJson['require-dev'] ?? []) - ); + $installedPackagesNames = $this->getInstalledPackagesNames(); foreach ($this->devPackages as $devPackage) { - if (in_array($devPackage, $installedPackages)) { + if (in_array($devPackage, $installedPackagesNames)) { $this->addFinding([ 'package' => $devPackage, 'title' => 'Development package detected in production', @@ -104,6 +101,27 @@ private function getComposerJson(): ?array return json_decode($composerJsonContent, true); } + private function getInstalledPackagesNames(): array + { + $installedPackages = $this->getInstalledPackages(); + + return isset($installedPackages['packages']) + ? array_column($installedPackages['packages'], 'name') + : []; + } + + private function getInstalledPackages(): array + { + $installedPath = base_path('vendor/composer/installed.json'); + + if (!file_exists($installedPath)) { + return []; + } + + $installedContents = file_get_contents($installedPath); + return json_decode($installedContents, true); + } + private function hasExposedTestingRoutes(): bool { $routeCollection = \Route::getRoutes(); From 9644482725cd1bdf756be1bb61a009ddf67f6c92 Mon Sep 17 00:00:00 2001 From: marklanser Date: Wed, 24 Dec 2025 11:12:13 +0100 Subject: [PATCH 3/4] Remove if statement re composer json --- src/Services/Audits/DebugModeAuditService.php | 37 +++++++++---------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/src/Services/Audits/DebugModeAuditService.php b/src/Services/Audits/DebugModeAuditService.php index f76eb94..40878d9 100644 --- a/src/Services/Audits/DebugModeAuditService.php +++ b/src/Services/Audits/DebugModeAuditService.php @@ -32,21 +32,18 @@ public function run(): bool // Only check for development packages if we're actually running in production if ($this->isActuallyProduction()) { - // Check for development packages in composer.json - $composerJson = $this->getComposerJson(); - if ($composerJson) { - $installedPackagesNames = $this->getInstalledPackagesNames(); - - foreach ($this->devPackages as $devPackage) { - if (in_array($devPackage, $installedPackagesNames)) { - $this->addFinding([ - 'package' => $devPackage, - 'title' => 'Development package detected in production', - 'severity' => 'high', - 'cve' => null, - 'affected_versions' => null - ]); - } + // Check for development packages in vendor/composer/installed.json + $installedPackagesNames = $this->getInstalledPackagesNames(); + + foreach ($this->devPackages as $devPackage) { + if (in_array($devPackage, $installedPackagesNames)) { + $this->addFinding([ + 'package' => $devPackage, + 'title' => 'Development package detected in production', + 'severity' => 'high', + 'cve' => null, + 'affected_versions' => null + ]); } } @@ -125,7 +122,7 @@ private function getInstalledPackages(): array private function hasExposedTestingRoutes(): bool { $routeCollection = \Route::getRoutes(); - + // Check debugbar routes separately as they're allowed when APP_DEBUG is true foreach ($routeCollection as $route) { $uri = $route->uri(); @@ -137,14 +134,14 @@ private function hasExposedTestingRoutes(): bool continue; } - + // Check other testing routes that should never be exposed in production $testingRoutes = [ 'telescope', 'horizon', '_dusk', ]; - + foreach ($testingRoutes as $testingRoute) { if (str_starts_with($uri, $testingRoute)) { return true; @@ -169,7 +166,7 @@ private function hasProtectiveMiddleware($route): bool 'role:', 'Barryvdh\Debugbar\Middleware\DebugbarEnabled' ]; - + foreach ($middleware as $m) { foreach ($protectiveMiddleware as $protect) { if (str_starts_with($m, $protect)) { @@ -177,7 +174,7 @@ private function hasProtectiveMiddleware($route): bool } } } - + return false; } From d9b23a97086bb875981ce1a102201700e3ae8f99 Mon Sep 17 00:00:00 2001 From: marklanser Date: Wed, 24 Dec 2025 11:13:39 +0100 Subject: [PATCH 4/4] Remove function get composer json --- src/Services/Audits/DebugModeAuditService.php | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/src/Services/Audits/DebugModeAuditService.php b/src/Services/Audits/DebugModeAuditService.php index 40878d9..69f3c0a 100644 --- a/src/Services/Audits/DebugModeAuditService.php +++ b/src/Services/Audits/DebugModeAuditService.php @@ -84,20 +84,6 @@ public function run(): bool return true; } - /** - * @return array|null - */ - private function getComposerJson(): ?array - { - $composerPath = base_path('composer.json'); - if (!file_exists($composerPath)) { - return null; - } - - $composerJsonContent = file_get_contents($composerPath); - return json_decode($composerJsonContent, true); - } - private function getInstalledPackagesNames(): array { $installedPackages = $this->getInstalledPackages();