Page MenuHomePhabricator

Security review of symfony/validator library
Closed, ResolvedPublic

Description

WikibaseLexeme uses some classes from symfony/validator PHP library for validating its API requests.
The library is not part of mediawiki vendor component yet, so it would need to go through security review before it, and WikibaseLexeme, get deployed.

The library on packagist: https://packagist.org/packages/symfony/validator.

Library source code: https://github.com/symfony/validator.
We intend to use version 3.4.7 of the library for the time being (as the 4.x branch is PHP 7+).

The library has several dependencies:

  • symfony/polyfill-mbstring (already part of mediawiki vendor, thus I assume does not require security review)
  • symfony/translation (also version 3.4.7, source code at https://github.com/symfony/translation)

The soon the review is possible, the better for the requesters. Being able to get the review happened by mid May 2018 would be absolutely fantastic.

We (WMDE Tech/Wikidata dev team) intend to use the library in WikibaseLexeme, with possibility to extend its usage in the other Wikibase-related code.
Library is pretty generic, and it could find other usage in both MediaWiki core, and other extensions. For example, it has been mentioned in T90885 back in 2015.

Should any further information needed to be provided, I will do it.

Resolved by Email:

Screen Shot 2018-05-09 at 12.45.27.png (224×1 px, 37 KB)

Related Objects

Event Timeline

WMDE-leszek created this task.

I note for naive purposes... On master his is a lot of code (even if it does include tests, though those have been know to cause problems in the past, for example for non executed code like we had with phpunit T180231) (slightly less in older branches)

The fact it needs a separate translation library is kinda crappy too... Not that we can really de-couple it, but are you using that functionality too?

reedy@ko-kra:~/translation$ wc -l `find . -iname "*.php"`
   271 ./MessageCatalogue.php
   136 ./MessageCatalogueInterface.php
    99 ./Util/ArrayConverter.php
    67 ./TranslatorInterface.php
    33 ./TranslatorBagInterface.php
   437 ./Translator.php
   269 ./Command/XliffLintCommand.php
    21 ./Exception/InvalidArgumentException.php
    21 ./Exception/NotFoundResourceException.php
    21 ./Exception/LogicException.php
    21 ./Exception/ExceptionInterface.php
    21 ./Exception/InvalidResourceException.php
    21 ./Exception/RuntimeException.php
   109 ./Interval.php
    63 ./IdentityTranslator.php
   208 ./PluralizationRules.php
    31 ./Dumper/DumperInterface.php
   113 ./Dumper/FileDumper.php
    82 ./Dumper/MoFileDumper.php
    38 ./Dumper/PhpFileDumper.php
    45 ./Dumper/IniFileDumper.php
    63 ./Dumper/CsvFileDumper.php
    50 ./Dumper/QtFileDumper.php
    62 ./Dumper/YamlFileDumper.php
    44 ./Dumper/JsonFileDumper.php
    61 ./Dumper/PoFileDumper.php
   205 ./Dumper/XliffFileDumper.php
   106 ./Dumper/IcuResFileDumper.php
    38 ./Extractor/ExtractorInterface.php
    60 ./Extractor/ChainExtractor.php
    80 ./Extractor/AbstractFileExtractor.php
   256 ./Extractor/PhpExtractor.php
   142 ./Extractor/PhpStringTokenParser.php
    49 ./Tests/IntervalTest.php
    74 ./Tests/Util/ArrayConverterTest.php
   311 ./Tests/TranslatorCacheTest.php
   137 ./Tests/MessageSelectorTest.php
   166 ./Tests/Command/XliffLintCommandTest.php
    92 ./Tests/DataCollectorTranslatorTest.php
   549 ./Tests/TranslatorTest.php
    96 ./Tests/IdentityTranslatorTest.php
    29 ./Tests/Dumper/IcuResFileDumperTest.php
    66 ./Tests/Dumper/FileDumperTest.php
    29 ./Tests/Dumper/PhpFileDumperTest.php
    29 ./Tests/Dumper/QtFileDumperTest.php
    29 ./Tests/Dumper/MoFileDumperTest.php
    47 ./Tests/Dumper/YamlFileDumperTest.php
    30 ./Tests/Dumper/CsvFileDumperTest.php
    29 ./Tests/Dumper/PoFileDumperTest.php
   115 ./Tests/Dumper/XliffFileDumperTest.php
    29 ./Tests/Dumper/IniFileDumperTest.php
    39 ./Tests/Dumper/JsonFileDumperTest.php
    95 ./Tests/Extractor/PhpExtractorTest.php
   150 ./Tests/DataCollector/TranslationDataCollectorTest.php
    49 ./Tests/fixtures/extractor/translation.html.php
     5 ./Tests/fixtures/resources.php
    50 ./Tests/LoggingTranslatorTest.php
    48 ./Tests/DependencyInjection/TranslationDumperPassTest.php
    66 ./Tests/DependencyInjection/TranslationExtractorPassTest.php
    57 ./Tests/DependencyInjection/TranslationPassTest.php
    83 ./Tests/Catalogue/MergeOperationTest.php
    74 ./Tests/Catalogue/AbstractOperationTest.php
    82 ./Tests/Catalogue/TargetOperationTest.php
   122 ./Tests/PluralizationRulesTest.php
    82 ./Tests/Formatter/MessageFormatterTest.php
    69 ./Tests/Writer/TranslationWriterTest.php
    61 ./Tests/Loader/CsvFileLoaderTest.php
    71 ./Tests/Loader/YamlFileLoaderTest.php
    72 ./Tests/Loader/MoFileLoaderTest.php
    50 ./Tests/Loader/PhpFileLoaderTest.php
    51 ./Tests/Loader/IcuResFileLoaderTest.php
    62 ./Tests/Loader/JsonFileLoaderTest.php
   109 ./Tests/Loader/PoFileLoaderTest.php
    64 ./Tests/Loader/IcuDatFileLoaderTest.php
   260 ./Tests/Loader/XliffFileLoaderTest.php
    51 ./Tests/Loader/IniFileLoaderTest.php
    75 ./Tests/Loader/QtFileLoaderTest.php
    24 ./Tests/Loader/LocalizedTestCase.php
   222 ./Tests/MessageCatalogueTest.php
   165 ./DataCollectorTranslator.php
   167 ./DataCollector/TranslationDataCollector.php
    94 ./MessageSelector.php
   136 ./LoggingTranslator.php
    49 ./DependencyInjection/TranslationExtractorPass.php
    79 ./DependencyInjection/TranslatorPass.php
    44 ./DependencyInjection/TranslationDumperPass.php
    77 ./Catalogue/OperationInterface.php
    69 ./Catalogue/TargetOperation.php
    55 ./Catalogue/MergeOperation.php
   158 ./Catalogue/AbstractOperation.php
    63 ./Reader/TranslationReader.php
    30 ./Reader/TranslationReaderInterface.php
    54 ./MetadataAwareInterface.php
    48 ./Formatter/MessageFormatter.php
    30 ./Formatter/ChoiceMessageFormatterInterface.php
    30 ./Formatter/MessageFormatterInterface.php
    34 ./Writer/TranslationWriterInterface.php
    90 ./Writer/TranslationWriter.php
   314 ./Loader/XliffFileLoader.php
    38 ./Loader/LoaderInterface.php
    65 ./Loader/CsvFileLoader.php
    65 ./Loader/FileLoader.php
    77 ./Loader/QtFileLoader.php
   145 ./Loader/MoFileLoader.php
    64 ./Loader/JsonFileLoader.php
    50 ./Loader/YamlFileLoader.php
    28 ./Loader/IniFileLoader.php
    28 ./Loader/PhpFileLoader.php
    66 ./Loader/ArrayLoader.php
    61 ./Loader/IcuDatFileLoader.php
    91 ./Loader/IcuResFileLoader.php
   148 ./Loader/PoFileLoader.php
 10155 total

reedy@ko-kra:~/validator$ wc -l `find . -iname "*.php"`
   832 ./Validator/RecursiveContextualValidator.php
   124 ./Validator/RecursiveValidator.php
    88 ./Validator/ContextualValidatorInterface.php
   135 ./Validator/TraceableValidator.php
    97 ./Validator/ValidatorInterface.php
    65 ./ConstraintViolationListInterface.php
   178 ./ConstraintViolation.php
    56 ./Util/PropertyPath.php
    37 ./Constraints/LessThanOrEqualValidator.php
    22 ./Constraints/Required.php
    39 ./Constraints/BlankValidator.php
    30 ./Constraints/NotIdenticalTo.php
    30 ./Constraints/IdenticalTo.php
    61 ./Constraints/Callback.php
    24 ./Constraints/GroupSequenceProvider.php
    37 ./Constraints/NotEqualToValidator.php
    85 ./Constraints/Collection.php
    39 ./Constraints/NotNullValidator.php
    89 ./Constraints/Image.php
    37 ./Constraints/EqualToValidator.php
    31 ./Constraints/Country.php
    86 ./Constraints/Ip.php
    30 ./Constraints/GreaterThanOrEqual.php
    60 ./Constraints/CountValidator.php
    38 ./Constraints/All.php
    39 ./Constraints/Bic.php
    85 ./Constraints/BicValidator.php
    55 ./Constraints/TypeValidator.php
   238 ./Constraints/FileValidator.php
    58 ./Constraints/LocaleValidator.php
    77 ./Constraints/Uuid.php
    37 ./Constraints/Luhn.php
   102 ./Constraints/IpValidator.php
    39 ./Constraints/IsNullValidator.php
    39 ./Constraints/NotBlankValidator.php
   184 ./Constraints/IsbnValidator.php
   102 ./Constraints/Regex.php
    41 ./Constraints/IsFalseValidator.php
    44 ./Constraints/Issn.php
    65 ./Constraints/ExpressionValidator.php
    71 ./Constraints/Email.php
   122 ./Constraints/Url.php
    48 ./Constraints/AllValidator.php
    33 ./Constraints/Date.php
   257 ./Constraints/IbanValidator.php
    66 ./Constraints/Expression.php
   128 ./Constraints/CardSchemeValidator.php
    37 ./Constraints/LessThanValidator.php
    31 ./Constraints/IsTrue.php
    33 ./Constraints/Time.php
    48 ./Constraints/Type.php
    31 ./Constraints/Language.php
   155 ./Constraints/Composite.php
    36 ./Constraints/DateTime.php
    30 ./Constraints/GreaterThan.php
    76 ./Constraints/DateValidator.php
    53 ./Constraints/Isbn.php
    80 ./Constraints/RangeValidator.php
    31 ./Constraints/Blank.php
    37 ./Constraints/GreaterThanValidator.php
   256 ./Constraints/UuidValidator.php
    41 ./Constraints/Iban.php
    58 ./Constraints/Length.php
    41 ./Constraints/Locale.php
    49 ./Constraints/Range.php
    90 ./Constraints/GroupSequence.php
    30 ./Constraints/Existence.php
    31 ./Constraints/NotBlank.php
   169 ./Constraints/EmailValidator.php
    61 ./Constraints/CallbackValidator.php
   133 ./Constraints/IssnValidator.php
    45 ./Constraints/Valid.php
    22 ./Constraints/Optional.php
    47 ./Constraints/CardScheme.php
    38 ./Constraints/ValidValidator.php
    31 ./Constraints/IsFalse.php
    63 ./Constraints/AbstractComparison.php
    52 ./Constraints/Choice.php
    76 ./Constraints/TimeValidator.php
    32 ./Constraints/Currency.php
    74 ./Constraints/DateTimeValidator.php
    43 ./Constraints/IsTrueValidator.php
    31 ./Constraints/NotNull.php
   237 ./Constraints/ImageValidator.php
    30 ./Constraints/LessThan.php
    30 ./Constraints/LessThanOrEqual.php
   104 ./Constraints/UrlValidator.php
    37 ./Constraints/NotIdenticalToValidator.php
    96 ./Constraints/LuhnValidator.php
    53 ./Constraints/Traverse.php
    54 ./Constraints/CurrencyValidator.php
    53 ./Constraints/CountryValidator.php
    37 ./Constraints/IdenticalToValidator.php
    31 ./Constraints/IsNull.php
    37 ./Constraints/GreaterThanOrEqualValidator.php
    86 ./Constraints/CollectionValidator.php
   121 ./Constraints/File.php
    53 ./Constraints/LanguageValidator.php
   106 ./Constraints/ChoiceValidator.php
    54 ./Constraints/Count.php
    52 ./Constraints/RegexValidator.php
    30 ./Constraints/NotEqualTo.php
    30 ./Constraints/EqualTo.php
   116 ./Constraints/AbstractComparisonValidator.php
    79 ./Constraints/LengthValidator.php
   181 ./ConstraintViolationList.php
   167 ./ConstraintValidator.php
    55 ./Context/ExecutionContextFactory.php
    36 ./Context/ExecutionContextFactoryInterface.php
   351 ./Context/ExecutionContext.php
   344 ./Context/ExecutionContextInterface.php
    48 ./ConstraintValidatorFactory.php
    31 ./ObjectInitializerInterface.php
    27 ./ConstraintValidatorFactoryInterface.php
   187 ./Mapping/MemberMetadata.php
    74 ./Mapping/PropertyMetadata.php
   169 ./Mapping/Factory/LazyLoadingMetadataFactory.php
    40 ./Mapping/Factory/BlackHoleMetadataFactory.php
    43 ./Mapping/Factory/MetadataFactoryInterface.php
    47 ./Mapping/PropertyMetadataInterface.php
    66 ./Mapping/MetadataInterface.php
   214 ./Mapping/GenericMetadata.php
    80 ./Mapping/GetterMetadata.php
    55 ./Mapping/TraversalStrategy.php
    59 ./Mapping/Cache/DoctrineCache.php
    71 ./Mapping/Cache/Psr6Cache.php
    43 ./Mapping/Cache/CacheInterface.php
    52 ./Mapping/CascadingStrategy.php
   105 ./Mapping/ClassMetadataInterface.php
    67 ./Mapping/Loader/LoaderChain.php
    61 ./Mapping/Loader/FilesLoader.php
    31 ./Mapping/Loader/XmlFilesLoader.php
    29 ./Mapping/Loader/LoaderInterface.php
    91 ./Mapping/Loader/AnnotationLoader.php
    51 ./Mapping/Loader/FileLoader.php
    66 ./Mapping/Loader/StaticMethodLoader.php
   192 ./Mapping/Loader/YamlFileLoader.php
    88 ./Mapping/Loader/AbstractLoader.php
   232 ./Mapping/Loader/XmlFileLoader.php
    31 ./Mapping/Loader/YamlFilesLoader.php
   504 ./Mapping/ClassMetadata.php
   310 ./Constraint.php
    19 ./Exception/UnsupportedMetadataException.php
    21 ./Exception/InvalidArgumentException.php
    29 ./Exception/MissingOptionsException.php
    21 ./Exception/OutOfBoundsException.php
    29 ./Exception/InvalidOptionsException.php
    21 ./Exception/BadMethodCallException.php
    19 ./Exception/NoSuchMetadataException.php
    21 ./Exception/ExceptionInterface.php
    16 ./Exception/MappingException.php
    16 ./Exception/ValidatorException.php
    21 ./Exception/RuntimeException.php
    20 ./Exception/UnexpectedTypeException.php
    16 ./Exception/GroupDefinitionException.php
    16 ./Exception/ConstraintDefinitionException.php
    52 ./Validation.php
    35 ./ConstraintValidatorInterface.php
   114 ./Violation/ConstraintViolationBuilderInterface.php
   180 ./Violation/ConstraintViolationBuilder.php
   122 ./ConstraintViolationInterface.php
  1232 ./Tests/Validator/AbstractValidatorTest.php
   708 ./Tests/Validator/AbstractTest.php
   104 ./Tests/Validator/TraceableValidatorTest.php
    98 ./Tests/Validator/RecursiveValidatorTest.php
    48 ./Tests/Resources/TranslationFilesTest.php
    37 ./Tests/Util/PropertyPathTest.php
   266 ./Tests/Constraints/IsbnValidatorTest.php
   247 ./Tests/Constraints/LengthValidatorTest.php
   101 ./Tests/Constraints/NotBlankValidatorTest.php
    73 ./Tests/Constraints/ValidValidatorTest.php
   148 ./Tests/Constraints/CompositeTest.php
   108 ./Tests/Constraints/DateValidatorTest.php
   445 ./Tests/Constraints/IbanValidatorTest.php
    25 ./Tests/Constraints/CountValidatorCountableTest.php
    88 ./Tests/Constraints/AllValidatorTest.php
   122 ./Tests/Constraints/LuhnValidatorTest.php
   105 ./Tests/Constraints/CountryValidatorTest.php
    81 ./Tests/Constraints/GreaterThanOrEqualValidatorTest.php
    35 ./Tests/Constraints/GroupSequenceTest.php
   113 ./Tests/Constraints/CollectionTest.php
   216 ./Tests/Constraints/UuidValidatorTest.php
    20 ./Tests/Constraints/CollectionValidatorArrayTest.php
    22 ./Tests/Constraints/CollectionValidatorCustomArrayObjectTest.php
    93 ./Tests/Constraints/RegexValidatorTest.php
   133 ./Tests/Constraints/DateTimeValidatorTest.php
   198 ./Tests/Constraints/CountValidatorTest.php
   451 ./Tests/Constraints/IpValidatorTest.php
   373 ./Tests/Constraints/UrlValidatorTest.php
   138 ./Tests/Constraints/CardSchemeValidatorTest.php
    78 ./Tests/Constraints/EqualToValidatorTest.php
    88 ./Tests/Constraints/RegexTest.php
   256 ./Tests/Constraints/CallbackValidatorTest.php
   107 ./Tests/Constraints/CurrencyValidatorTest.php
   384 ./Tests/Constraints/CollectionValidatorTest.php
    62 ./Tests/Constraints/IsNullValidatorTest.php
   105 ./Tests/Constraints/LanguageValidatorTest.php
    22 ./Tests/Constraints/FileValidatorObjectTest.php
    52 ./Tests/Constraints/IsFalseValidatorTest.php
    82 ./Tests/Constraints/LessThanValidatorTest.php
   109 ./Tests/Constraints/TimeValidatorTest.php
    23 ./Tests/Constraints/CountValidatorArrayTest.php
    42 ./Tests/Constraints/AllTest.php
    30 ./Tests/Constraints/Fixtures/ChildA.php
    29 ./Tests/Constraints/Fixtures/ChildB.php
    96 ./Tests/Constraints/IdenticalToValidatorTest.php
   287 ./Tests/Constraints/ExpressionValidatorTest.php
   107 ./Tests/Constraints/BicValidatorTest.php
   396 ./Tests/Constraints/EmailValidatorTest.php
   139 ./Tests/Constraints/FileTest.php
    83 ./Tests/Constraints/GreaterThanValidatorTest.php
    35 ./Tests/Constraints/ValidTest.php
    84 ./Tests/Constraints/LessThanOrEqualValidatorTest.php
    58 ./Tests/Constraints/NotNullValidatorTest.php
   182 ./Tests/Constraints/IssnValidatorTest.php
    65 ./Tests/Constraints/BlankValidatorTest.php
   411 ./Tests/Constraints/ImageValidatorTest.php
   213 ./Tests/Constraints/LocaleValidatorTest.php
   182 ./Tests/Constraints/TypeValidatorTest.php
   298 ./Tests/Constraints/ChoiceValidatorTest.php
   268 ./Tests/Constraints/AbstractComparisonValidatorTestCase.php
   473 ./Tests/Constraints/FileValidatorTest.php
    20 ./Tests/Constraints/CollectionValidatorArrayObjectTest.php
    45 ./Tests/Constraints/EmailTest.php
    36 ./Tests/Constraints/FileValidatorPathTest.php
   392 ./Tests/Constraints/RangeValidatorTest.php
    96 ./Tests/Constraints/NotIdenticalToValidatorTest.php
    52 ./Tests/Constraints/IsTrueValidatorTest.php
    78 ./Tests/Constraints/NotEqualToValidatorTest.php
    56 ./Tests/Mapping/PropertyMetadataTest.php
   203 ./Tests/Mapping/Factory/LazyLoadingMetadataFactoryTest.php
    34 ./Tests/Mapping/Factory/BlackHoleMetadataFactoryTest.php
    72 ./Tests/Mapping/GetterMetadataTest.php
   323 ./Tests/Mapping/ClassMetadataTest.php
    84 ./Tests/Mapping/MemberMetadataTest.php
    79 ./Tests/Mapping/Cache/AbstractCacheTest.php
    26 ./Tests/Mapping/Cache/Psr6CacheTest.php
    23 ./Tests/Mapping/Cache/DoctrineCacheTest.php
   152 ./Tests/Mapping/Loader/YamlFileLoaderTest.php
   136 ./Tests/Mapping/Loader/XmlFileLoaderTest.php
    85 ./Tests/Mapping/Loader/LoaderChainTest.php
   140 ./Tests/Mapping/Loader/StaticMethodLoaderTest.php
    49 ./Tests/Mapping/Loader/FilesLoaderTest.php
   169 ./Tests/Mapping/Loader/AnnotationLoaderTest.php
    19 ./Tests/Mapping/Loader/AbstractStaticMethodLoader.php
    77 ./Tests/ContainerConstraintValidatorFactoryTest.php
   162 ./Tests/ConstraintViolationListTest.php
    31 ./Tests/Fixtures/ConstraintWithValue.php
    39 ./Tests/Fixtures/FilesLoader.php
    16 ./Tests/Fixtures/InvalidConstraintValidator.php
    18 ./Tests/Fixtures/InvalidConstraint.php
    36 ./Tests/Fixtures/GroupSequenceProviderEntity.php
    25 ./Tests/Fixtures/EntityStaticVehicle.php
    72 ./Tests/Fixtures/FakeMetadataFactory.php
    31 ./Tests/Fixtures/ConstraintA.php
    23 ./Tests/Fixtures/FailingConstraintValidator.php
    27 ./Tests/Fixtures/Countable.php
    16 ./Tests/Fixtures/EntityInterfaceB.php
    22 ./Tests/Fixtures/ToString.php
    29 ./Tests/Fixtures/Reference.php
    26 ./Tests/Fixtures/FakeClassMetadata.php
    16 ./Tests/Fixtures/EntityParentInterface.php
    22 ./Tests/Fixtures/ClassConstraint.php
    31 ./Tests/Fixtures/EntityParent.php
    23 ./Tests/Fixtures/ConstraintB.php
    23 ./Tests/Fixtures/EntityStaticCarTurbo.php
    70 ./Tests/Fixtures/CustomArrayObject.php
    16 ./Tests/Fixtures/GroupSequenceProviderChildEntity.php
   144 ./Tests/Fixtures/Entity.php
    16 ./Tests/Fixtures/EntityInterfaceA.php
    24 ./Tests/Fixtures/CallbackClass.php
    31 ./Tests/Fixtures/ConstraintWithValueAsDefault.php
    22 ./Tests/Fixtures/PropertyConstraint.php
    24 ./Tests/Fixtures/FailingConstraint.php
    37 ./Tests/Fixtures/ConstraintAValidator.php
    30 ./Tests/Fixtures/ConstraintC.php
    23 ./Tests/Fixtures/EntityStaticCar.php
    56 ./Tests/ConstraintViolationTest.php
    79 ./Tests/DataCollector/ValidatorDataCollectorTest.php
   117 ./Tests/ValidatorBuilderTest.php
    78 ./Tests/DependencyInjection/AddConstraintValidatorsPassTest.php
    44 ./Tests/DependencyInjection/AddValidatorInitializersPassTest.php
   245 ./Tests/ConstraintTest.php
   112 ./DataCollector/ValidatorDataCollector.php
   331 ./ValidatorBuilder.php
   342 ./Test/ConstraintValidatorTestCase.php
    26 ./GroupSequenceProviderInterface.php
    46 ./DependencyInjection/AddValidatorInitializersPass.php
    56 ./DependencyInjection/AddConstraintValidatorsPass.php
    62 ./ContainerConstraintValidatorFactory.php
   158 ./ValidatorBuilderInterface.php
 29080 total
reedy@ko-kra:~/validator$

@Reedy We are not using the translation functionality but rather pass in/through i18n keys and translate them using mediawiki core technology once they occur.

The test files are excluded from class map and should not be reachable by autoloading.

The test files are excluded from class map and should not be reachable by autoloading.

Doesn't stop things like happened in T180231 if the files are on disk and accessible.

It's a minor concern FWIW

@Reedy If it helps we can certainly look into adding validator's /tests to .gitignore - so it does not make it onto disk.

@Reedy If it helps we can certainly look into adding validator's /tests to .gitignore - so it does not make it onto disk.

Not loading /tests from libraries in the mediawiki-vendor lib should already be done.
For wmde controlled repos this is done using a .gitattributes file in the repo root.
https://github.com/wmde/WikibaseDataModel/blob/master/.gitattributes#L10

For external libraries we could probably enforce a .gitignore rule always excluding tests from the mediawiki-vendor dir.

Isn't that .gitattributes job?

That would probably have been the right way (tm) of doing things. But it is also not code owned by us.

I'm going to try getting .gitattributes to those two libs, although looking at the history, Symfony folks seem to have been removing .gitattributes rather than adding them.

But in fact it feels more flexible and right (tm) to allow the user library decide what part of it they want to use etc.
To have something graspable, I made a proof of concept of what we might be talking about: https://gerrit.wikimedia.org/r/#/c/425820/

But in fact it feels more flexible and right (tm) to allow the user library what part of it they want to use etc.
To have something graspable, I made a proof of concept of what we might talking about: https://gerrit.wikimedia.org/r/#/c/425820/

+1

FWIW, T192453 filed as a discussion/TODO as to whether we actually need to do a security review for libraries from well known developers like Symfony

Hey @Reedy,

May I ask for a resolution for this ticket? we have our release on May 23rd and we are stuck on it...

I'm happy that we filed it to T192453: Remove requirement for security review of well maintained third party libraries, but we really need to resolve it asap.

Thanks,
Raz.

RazShuty updated the task description. (Show Details)