Should psy/psysh be require-dev?

[phpguru]

I'm probably biased due to my current situation, and/or don't fully understand composer with --production.

I am trying to get my Laravel Spark application ready for production in a secure environment. Psy/psysh came up with a security issue after doing composer install --production on the project to prepare it for a security audit. I am trying to think of a use case for tinker to be used in production, and it would seem (to me anyway) that psy/psysh would be better suited to require-dev.

Am I misunderstanding how composer works? Or would it make sense to move psy/psysh to require-dev?

[GrahamCampbell]

require-dev isn't inheritted across packages. You can put the tinker package in your require-dev if you want though.

[bobthecow]

Psy/psysh came up with a security issue … 

Curious what that issue was, if you can share :)

[phpguru]

I am trying to wade through security scan CWE's on a Laravel + Spark project. Seems to me tinker is only useful in local development (I am often wrong) and hence my thinking was if it was require-dev it would not be included in builds made with composer install --production. The issue raised was CWE-78 at ProcOutputPager.php line 92.

[phpguru]

@GrahamCampbell so if package A has require B and B has require-dev C and I build with composer install --production then C is included? If so, that's somewhat counter-intuitive to me.

[bobthecow]

Huh. What do you think it'd take to exploit that?

[phpguru]

I'm not super familiar with tinker -> psysh, but since $cmd is passed directly to the constructor and not sanitized in any way, the library can apparently be used to execute arbitrary bash commands against the target system.

[bobthecow]

tinker (psysh) is an interactive PHP shell. it can be used to execute arbitrary bash commands against the target system, i promise :)

the pager process is lazily initialized, not created by the constructor. the only way to call getPipe, as far as i can tell, is arbitrary code execution. and at that point, you could just call proc_open yourself.

[phpguru]

The security scan reveals potential security risks, the vast majority of which are false positives. Thanks for the replies. I'll add your note.

[GrahamCampbell]

The security scan reveals potential security risks,

DOn't install the tinker package then, nothing to do with psysh as such?

[phpguru]

You're right. I got my wires crossed. My project requires laravel/framework, laravel/framework requires psy/psysh. I was hoping for some vendor-controlled packages to consider moving non-essential dependencies to require-dev but it seems most are baked in. This entire thread should've been on laravel/framework - my apologies.

[GrahamCampbell]

Laravel 5.4 moved the dependency out of the core, so you can opt-out if you want. That's why I created this tinker package. I think this is what you're asking?

[SoundousBahri]

Don't remove Tinker from production or else you'll break your website!

[ken-sands]

Not true at all, removing tinker and psysh from production works just fine. The lack of focus on what is needed on a secure production server rather than what is nice for devs is my biggest gripe with laravel. Very little documentation out there on it. No tinker, no psysh, no composer and no supervisord on production for us.