ClamAV Scanner for Flysystem

 

ns files for malware using the ClamAV antivirus engine. The readme explains in more detail how this adapter works in tandem with a “backing” adapter:

This package provides a filesystem adapter for Flysystem that scans files being read from and written to an underlying filesystem using the popular ClamAV antivirus engine. This adapter acts as a passthrough adapter, sitting in between your application and whichever concrete Flysystem adapter you use to store your files. Since this scanner is itself a Flysystem adapter, it can be implemented in an existing application simply by dropping it in as a replacement to your existing Flysystem adapter so that all filesytem calls go through the ClamAV adapter.

Here’s a gist of the setup, which requires a few things: the backing adapter (i.e., local), the Quahog ClamAV integration library, and the ClamAvScannerAdapter from this package:

use League\Flysystem\Adapter\Local;
use Socket\Raw\Factory as SocketFactory;
use Xenolope\Quahog\Client as ClamAVScanner;
use League\Flysystem\Filesystem;
use mgriego\Flysystem\ClamAV\ClamAvScannerAdapter;


$backingAdapter = new Local(__DIR__.'/path/to/root');


// Create a new socket instance
$socket = (new SocketFactory())->createClient('tcp://127.0.0.1:3310');


// Create a new instance of the Client
$quahog = new ClamAVScanner($socket);


// In this case, copies will be scanned.
$adapter = new ClamAvScannerAdapter($quahog, $backingAdapter, true);
$filesystem = new Filesystem($adapter)

During usage, files are scanned during the following operations:

• read / readStream
• write / writeStream
• update / updateStream
• copy if the adapter is configured as such

If ClamAV detects malware in the file during any of those operations, the ClamAvScannerAdapter will throw a VirusFoundException exception. The getReason() method will give you the name of the malware detected and getPath() will provide the path of the file in question.

I would recommend going through the readme, which details the background of how to use this adapter as well as properly using the clamd daemon. To learn more about this package, get full installation instructions, and view the source code on GitHub at mgriego/flysystem-clamav.

Related: ClamAV Anti-Virus Validator for Laravel

Read More

Mask Sensitive Data With the PHP Masked Package

Fuko\Masked is a small PHP library by Kaloyan Tsvetkov for masking sensitive data by replacing blacklisted elements with a redacted value.

Here’s an example of the basic usage from the package’s readme:

use Fuko\Masked\Protect;

// hide the value inside the $secret_key var
Protect::hideValue($secret_key);

// hide the value of $_POST['password']
Protect::hideInput('password', INPUT_POST);

$redacted = Protect::protect($_POST);

Based on the above calls, the blacklisted values and inputs will be masked. Another example from the readme is a debug blacklist, similar to Laravel 5’s Whoops blacklist:

use \Fuko\Masked\Protect;

Protect::hideInputs(array(
    INPUT_ENV => array(
        'APP_KEY',
        'DB_PASSWORD',
        'REDIS_PASSWORD',
        'MAIL_PASSWORD',
        'PUSHER_APP_KEY',
        'PUSHER_APP_SECRET',
        ),
    INPUT_SERVER => array(
        'PHP_AUTH_PW',
        'APP_KEY',
        'DB_PASSWORD',
        'REDIS_PASSWORD',
        'MAIL_PASSWORD',
        'PUSHER_APP_KEY',
        'PUSHER_APP_SECRET',
        ),
    INPUT_POST => array(
        'password',
        )
    )
);

// Passing info through `\Fuko\Masked\Protect::protect()`
// will mask the blacklisted inputs.
\Fuko\Masked\Protect::protect($_POST);

Check out the readme for more examples, including custom masking rules. You can learn more about this package, get full installation instructions, and view the source code on GitHub at fuko-php/masked.

Related: PHP Array Redactor

Read More

Laravel Stats 2.0 is Here

 

Laravel Stats 2.0 was released recently with a bunch of changes and exciting features! If you’re not familiar, Laravel Stats is a rake-inspired package that gives you code statistics for your Laravel projects.

We originally covered Laravel Stats: Code Statistics for your Laravel Projects earlier this year, but it’s time to look at the shiny new features just released:

Differentiation between Application Code and Test Code

One of the stats is the ratio between application code and test code. In 2.0, each component can now be explicitly configured to count towards application or test code.

Verbose Mode

A new verbose flag (--verbose|-v) will list all the recognized classes for a component.

Filter Output by Component

A new --components flag was added to filter output by component type. An example of this flag is available in the readme:

php artisan stats --components=Migrations,Models
+------------+---------+---------+---------------+-----+------+-------------+
| Name       | Classes | Methods | Methods/Class | LoC | LLoC | LLoC/Method |
+------------+---------+---------+---------------+-----+------+-------------+
| Migrations |       3 |       6 |             2 | 103 |   31 |        5.17 |
| Models     |       1 |       0 |             0 |  39 |    8 |           0 |
+------------+---------+---------+---------------+-----+------+-------------+
| Total      |      29 |      31 |          1.07 | 950 |  167 |        5.39 |
+--- Code LLoC: 155 * Test LLoC: 12 * Code/Test Ratio: 1:0.1 * Routes: 2 ---+

You can see a list of component types in the project’s component classification table.

Learn More

If you are upgrading from a previous version or are curious for more 2.0 details, check out the notes for Release v2.0.0. You can learn more about this package, get full installation instructions, and view the source code on GitHub at stefanzweifel/laravel-stats.

Read More