The original post: /r/php by /u/plonkster on 2024-12-25 12:25:53.

I’m by no mean a PHP wizard, matter of fact I’m primarily a C developer and never wrote PHP professionally so I have a naive question for the people in the know.

I’ve been only writing PHP outside of frameworks, depending solely on things such as PHP extensions or system libraries packaged in Debian-stable. This pretty much reduced my security concerns to how much I trust Debian-stable, and that trust was always relatively high, as far as I’m concerned.

Recently, I started pondering refactoring an old web site of mine, written in 2001. It’s been running since then without issues. It is still used by a few tens of thousands of accounts every month and has a lot of user-facing surfaces - dealing with all kinds of user input and whatnot. Over the years I ported it to PHP8, but it’s mainly old code written 25 years ago when PHP4 was all the rage.

So I figured, might as well do something useful and redo the whole thing over the course of a few months on and off, and learn Laravel at the same time. I was already savoring all the new things I was going to learn and how I was going to be able to delegate all the boring stuff such as user auth, logging, DB, sessions to Laravel, while concentrating on the fun stuff.

So off I go, read up on Laravel, and follow their Chirper tutorial by doing a composer create-project laravel/laravel chirper

It pulls down a few files and I’m all pumped about how I’m going to redo the site with all the modern bells and whistles, websockets, reactivity, and how it’s going to be so much better.

Then, in the newly created project, I take a look in the vendor directory.

39 different directories. A find -type f . | wc -l says there are 8123 files that take 78 megabytes.

Now a honest and probably very naive question - am I supposed to feel safe about including all that code with autoload.php, or should I be worried, and if so - to which extent? Are those packages checked for security by some teams?

I tried to Google around and it looks like anyone can just submit a package to packagist. Now, for example, I’m looking at the file chirper/vendor/laravel/framework/composer.json and see all the requirements, for example tijsverkoyen/css-to-inline-styles": "^2.2.5" (just picked one randomly). If I understand correctly, that means "use that package of version 2.2.5 or higher, as long as its major version is 2.

Does it mean, that if tomorrow that user’s (tijsverkoyen) packagist account gets compromised in some way, and a malicious user releases a 2.2.6 version of the package that contains a backdoor, new installations of Laravel all over the world will happily pull and use that version, at least until it gets noticed and removed from packagist? Or is there some validation mechanism in place that prevents that?

Thanks for enlightening me.