Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Exclude user_guide if CodeIgniter is installed via Composer. #5843

Closed
indrakaw opened this issue Sep 25, 2019 · 6 comments
Closed

Exclude user_guide if CodeIgniter is installed via Composer. #5843

indrakaw opened this issue Sep 25, 2019 · 6 comments

Comments

@indrakaw
Copy link
Contributor

indrakaw commented Sep 25, 2019

This is probably similar to #3831.

If possible, I'd to exclude user_guide directory to keep the file size when using composer down. It's quite big, compared to core directories:

Installed with --prefer-dist

$ du -h --max-depth=1 | sort -h
280K    ./application
2.4M    ./system
11M     ./user_guide
13M     .

Installed with --prefer-source

$ du -h --max-depth=1 | sort -h
280K    ./application
2.4M    ./system
11M     ./user_guide
55M     ./.git
67M     .

I'm in favor of ignoring it, The idea is that when using the library as is on a prod server, you don't end up with files that can be used for full path disclosure.
https://www.owasp.org/index.php/Full_Path_Disclosure

Addendum:
My thoughts were that when you are using this (or any other package), I would typically look through the code and the documentation online instead of reading through a docs folder in the vendor directory.

@narfbg
Copy link
Contributor

narfbg commented Oct 8, 2019

Well, how do you propose to do that? The user_guide dir is included in the tag ...

@indrakaw
Copy link
Contributor Author

indrakaw commented Oct 8, 2019

I'm not familiar with composer packages. Normally, it can be excluded by add this line:

user_guide export-ignore

Into .gitattributes file.

@djunehor
Copy link

I agree with @indrakaw, installation via composer should be fast and light-weight, which means non-required files should be excluded. As suggested, the folder should be included in gitignore and an update pushed so that subsequent composer installations don't down user_guider folder.

@indrakaw
Copy link
Contributor Author

indrakaw commented Oct 18, 2019

Apparently all 3.X tags are updated with the current .gitattributes. I was trying to test by installing older version before one from issue I mentioned then compare it with the current one.

This might take while, I'm installing the package via composer as commit as version pointer.

Update:
The non-tagged version has no .gitattributes and this is the file list:

C:\xampp\htdocs\older-version\vendor\codeigniter\framework (master -> origin)
λ git status
On branch master
Your branch is behind 'origin/master' by 913 commits, and can be fast-forwarded.
  (use "git pull" to update your local branch)

nothing to commit, working tree clean

C:\xampp\htdocs\older-version\vendor\codeigniter\framework (master -> origin)
λ git log -n 1
commit 5d78fd839120419ba7c0642f120313543af99b99 (HEAD -> master)
Author: Andrey Andreev <narf@devilix.net>
Date:   Mon May 11 18:19:01 2015 +0300

    Fix an undefined variable error from fbde2798688ab99cfe3fdd22746d60f0877b2c27

C:\xampp\htdocs\older-version\vendor\codeigniter\framework (master -> origin)
λ ls
application/  composer.json  contributing.md  DCO.txt  index.php  license.txt  phpdoc.dist.xml  readme.rst  system/  tests/  user_guide_src/

C:\xampp\htdocs\older-version\vendor\codeigniter\framework (master -> origin)
λ C:\Users\nyancatz\scoop\apps\git\current\usr\bin\du.exe -h --max-depth 1
54M     ./.git
146K    ./application
2.3M    ./system
596K    ./tests
2.1M    ./user_guide_src
60M     .

It was installed via:

composer require codeigniter/framework:dev-master#5d78fd839120419ba7c0642f120313543af99b99

Update 2:
This is quite complicated. I have to understand how the releases work.
What's https://github.com/bcit-ci/CodeIgniter/blob/develop/build-release.sh for?

@indrakaw
Copy link
Contributor Author

I tried multiple tests and it works.

I had to forked the release branch then make a commit change on .gitattribute, link: https://github.com/indrakaw/CodeIgniter/tree/gitattribute-release-test

And this is the local test:

  1. Create empty directory then add following content into composer.json
{
    "repositories": [
        {
            "type": "vcs",
            "url": "https://github.com/indrakaw/CodeIgniter"
        }
    ],
    "require": {
        "codeigniter/framework": "dev-gitattribute-release-test"
    }
}
  1. Command-line execution procedures:
C:\xampp\htdocs\ci-forked
λ rm -rf composer.lock vendor\

C:\xampp\htdocs\ci-forked
λ composer install --prefer-dist
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 1 install, 0 updates, 0 removals
  - Installing codeigniter/framework (dev-gitattribute-release-test a06b8b1): Downloading (100%)
codeigniter/framework suggests installing paragonie/random_compat (Provides better randomness in PHP 5.x)
Writing lock file
Generating autoload files

C:\xampp\htdocs\ci-forked
λ ls -1 vendor\codeigniter\framework\
application/
composer.json
contributing.md
index.php
license.txt
readme.rst
system/

I tried another installation just by composer install without --prefer-dist, and the result:

C:\xampp\htdocs\ci-forked
λ ls -1 vendor\codeigniter\framework\
application/
composer.json
contributing.md
index.php
license.txt
readme.rst
system/
user_guide/

@gphg
Copy link
Contributor

gphg commented Jul 30, 2021

Hi. Is it possible to get user_guide_src excluded too?

Edit:

~/tmp/ci3-3.1-stable $ du -d 1 -h vendor/codeigniter/framework/
3.2M    vendor/codeigniter/framework/user_guide_src
524K    vendor/codeigniter/framework/application
380K    vendor/codeigniter/framework/tests
3.3M    vendor/codeigniter/framework/system
7.4M    vendor/codeigniter/framework/

Your contribution did reduce the package directory into several MiBs. You could've done it better by excluded the source file for user_guide too, as mentioned above:

I'm in favor of ignoring it, The idea is that when using the library as is on a prod server, you don't end up with files that can be used for full path disclosure.
https://www.owasp.org/index.php/Full_Path_Disclosure

Excluding the source file can be done by modify this line on .gitattributes:

user_guide_src

Into: user_guide_src export-ignore.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants