php - composer.lock 如何保护你的项目的恶意依赖

Question

在我的项目中，我检查了 composer.lock 文件在 github .
假设我需要在 composer.json 中有一个健康的依赖项，例如:

"require": {
    "foo/bar": "v3.0"
  },

我打电话后 Composer 安装 一个 composer.lock 文件被创建。

"packages": [
        {
            "name": "foo/bar",
            "version": "v3.0",
            "source": {
                "type": "git",
                "url": "https://github.com/foo/bar.git",
                "reference": "bbafb0edb791b23220563d113d00371ea42aedaa"
            },
            "type": "project",
            "license": [
                "MIT"
            ],
            "authors": [
                {
                    "name": "Mr.Foo",
                    "email": "mr.foo@bar.de"
                }
            ],
            "time": "2019-09-30T12:13:55+00:00"
        }

假设拥有 foo/bar 存储库的攻击者将删除 v3.0 标签。攻击者会为 v3.0 命名一个不同的提交。
有人可以确认 Composer 安装 将始终检查 composer.lock 安装依赖项？
如果我运行 Composer 安装 没有 composer.lock 文件 Composer 将使用新的引用(提交 ID)创建一个新的 .lock 文件。如果我运行 Composer 安装 与 composer.lock 文件 Composer 将坚持提交 ID(“reference”:“bbafb0edb791b23220563d113d00371ea42aedaa”，旧版 v3.0)。 Composer 不会加载恶意伪造 v3.0。 v3.0 指向 github 上的新提交 ID。

有人可以确认 composer.lock`s 引用 标签具有比 更高的优先级版本标签？ composer 是否完全保护我的项目免受这些类型的攻击？

Answer 1

TL; 博士;

毫无疑问，你的问题的答案是:

Yes, composer will protect you

要么它会根据您的 composer.lock 中规定的提交哈希安装软件包。 ，如果它存在于存储库中，只需忽略提交和版本之间的不匹配，它就会以非常直截了当的原因失败: “历史被改写了？”

这个问题确实激起了我的好奇心:我会说是的，否则，锁定锁定文件中的提交哈希将毫无用处，但为了正确性，我不得不对其进行测试。

所以这就是我所做的:

有一种“明显”的场景，攻击者真的会重写历史记录并删除标签与您的 composer.json 匹配的提交。约束

再想一想，还有一种情况是，攻击者会保留标记为您的约束的提交，但会添加更新的提交并使用与您的约束匹配的标签重新标记新提交

第一个场景:

我安装了一个基本包，到某个特定版本(不是最新的，只是为了有一个版本限制):

$ composer require psr/log:1.0.0

这让我最终得到了这个非常简单的 composer.json

{
    "require": {
        "psr/log": "1.0.0"
    }
}

还有这个 composer.lock

{
    "_readme": [
        "This file locks the dependencies of your project to a known state",
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
    "content-hash": "2865f724e23cffb23b3afd3a968e0359",
    "packages": [
        {
            "name": "psr/log",
            "version": "1.0.0",
            "source": {
                "type": "git",
                "url": "https://github.com/php-fig/log.git",
                "reference": "fe0936ee26643249e916849d48e3a51d5f5e278b"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/php-fig/log/zipball/fe0936ee26643249e916849d48e3a51d5f5e278b",
                "reference": "fe0936ee26643249e916849d48e3a51d5f5e278b",
                "shasum": ""
            },
            "type": "library",
            "autoload": {
                "psr-0": {
                    "Psr\\Log\\": ""
                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "authors": [
                {
                    "name": "PHP-FIG",
                    "homepage": "http://www.php-fig.org/"
                }
            ],
            "description": "Common interface for logging libraries",
            "keywords": [
                "log",
                "psr",
                "psr-3"
            ],
            "time": "2012-12-21T11:40:51+00:00"
        }
    ],
    "packages-dev": [],
    "aliases": [],
    "minimum-stability": "stable",
    "stability-flags": [],
    "prefer-stable": false,
    "prefer-lowest": false,
    "platform": [],
    "platform-dev": []
}

然后为了测试它，我只是改变了提交哈希 fe0936ee26643249e916849d48e3a51d5f5e278b我可以在 composer.lock 中找到它的任何地方按一个字符: fe0936ee26643249e916849d48e3a51d5f5e278c (最后一个 b 变成了 c )；以此结尾 composer.lock :

{
    "_readme": [
        "This file locks the dependencies of your project to a known state",
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
    "content-hash": "2865f724e23cffb23b3afd3a968e0359",
    "packages": [
        {
            "name": "psr/log",
            "version": "1.0.0",
            "source": {
                "type": "git",
                "url": "https://github.com/php-fig/log.git",
                "reference": "fe0936ee26643249e916849d48e3a51d5f5e278c"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/php-fig/log/zipball/fe0936ee26643249e916849d48e3a51d5f5e278c",
                "reference": "fe0936ee26643249e916849d48e3a51d5f5e278c",
                "shasum": ""
            },
            "type": "library",
            "autoload": {
                "psr-0": {
                    "Psr\\Log\\": ""
                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "authors": [
                {
                    "name": "PHP-FIG",
                    "homepage": "http://www.php-fig.org/"
                }
            ],
            "description": "Common interface for logging libraries",
            "keywords": [
                "log",
                "psr",
                "psr-3"
            ],
            "time": "2012-12-21T11:40:51+00:00"
        }
    ],
    "packages-dev": [],
    "aliases": [],
    "minimum-stability": "stable",
    "stability-flags": [],
    "prefer-stable": false,
    "prefer-lowest": false,
    "platform": [],
    "platform-dev": []
}

请注意:如果您在浏览器中尝试此操作，因为 Composer 稍后会为您执行此操作，您最终将得到一个 404 页面: https://api.github.com/repos/php-fig/log/zipball/fe0936ee26643249e916849d48e3a51d5f5e278c

我删除了我的 vendor文件夹，为此:

$ rm -Rf vendor

然后，重新运行依赖项安装，以以下输出结束:

$ composer install
Loading composer repositories with package information
Installing dependencies (including require-dev) from lock file
Package operations: 1 install, 0 updates, 0 removals
  - Installing psr/log (1.0.0): Downloading (0%)    Failed to download psr/log from dist: The "https://codeload.github.com/php-fig/log/legacy.zip/fe0936ee26643249e916849d48e3a51d5f5e278c" file could not be downloaded (HTTP/1.1 404 Not Found)
    Now trying to download from source
  - Installing psr/log (1.0.0): Cloning fe0936ee26 from cache
    fe0936ee26643249e916849d48e3a51d5f5e278c is gone (history was rewritten?)


  [RuntimeException]                                                                                                                  
  Failed to execute git checkout 'fe0936ee26643249e916849d48e3a51d5f5e278c' -- && git reset --hard 'fe0936ee26643249e916849d48e3a51d  
  5f5e278c' --                                                                                                                        

  fatal: reference is not a tree: fe0936ee26643249e916849d48e3a51d5f5e278c                                                            


install [--prefer-source] [--prefer-dist] [--dry-run] [--dev] [--no-dev] [--no-custom-installers] [--no-autoloader] [--no-scripts] [--no-progress] [--no-suggest] [-v|vv|vvv|--verbose] [-o|--optimize-autoloader] [-a|--classmap-authoritative] [--apcu-autoloader] [--ignore-platform-reqs] [--] [<packages>]...

如果你只有一行来读出这个输出，那就是:

fe0936ee26643249e916849d48e3a51d5f5e278c is gone (history was rewritten?)

第二种情况:

这一次，我在 php-fig/log 的存储库中做了一些挖掘。找到存储库的初始提交: https://github.com/php-fig/log/commit/a7ab552fdb2efb80aeca09da3bbd9335fc945ff0

而且，以同样的方式，我编辑了我的 composer.lock ，但这次伪造了一个事实，即 repo 的初始提交是标记为 1.0.0 的那个。 ，当是 obviously not .

这让我得到了这个 composer.lock

{
    "_readme": [
        "This file locks the dependencies of your project to a known state",
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
    "content-hash": "2865f724e23cffb23b3afd3a968e0359",
    "packages": [
        {
            "name": "psr/log",
            "version": "1.0.0",
            "source": {
                "type": "git",
                "url": "https://github.com/php-fig/log.git",
                "reference": "a7ab552fdb2efb80aeca09da3bbd9335fc945ff0"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/php-fig/log/zipball/a7ab552fdb2efb80aeca09da3bbd9335fc945ff0",
                "reference": "a7ab552fdb2efb80aeca09da3bbd9335fc945ff0",
                "shasum": ""
            },
            "type": "library",
            "autoload": {
                "psr-0": {
                    "Psr\\Log\\": ""
                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "authors": [
                {
                    "name": "PHP-FIG",
                    "homepage": "http://www.php-fig.org/"
                }
            ],
            "description": "Common interface for logging libraries",
            "keywords": [
                "log",
                "psr",
                "psr-3"
            ],
            "time": "2012-12-21T11:40:51+00:00"
        }
    ],
    "packages-dev": [],
    "aliases": [],
    "minimum-stability": "stable",
    "stability-flags": [],
    "prefer-stable": false,
    "prefer-lowest": false,
    "platform": [],
    "platform-dev": []
}

请注意:这次尝试，将下载包含初始提交时的存储库状态的 zip: https://api.github.com/repos/php-fig/log/zipball/a7ab552fdb2efb80aeca09da3bbd9335fc945ff0

重复以上删除 vendor文件夹

$ rm -Rf vendor

这次也清除了 Composer 缓存，因为剧透警告，安装 将 成功:

$ composer clearcache && rm -Rf vendor
Clearing cache (cache-vcs-dir): /tmp/cache/vcs
Clearing cache (cache-repo-dir): /tmp/cache/repo
Clearing cache (cache-files-dir): /tmp/cache/files
Clearing cache (cache-dir): /tmp/cache
All caches cleared.

然后，重新运行依赖项安装，以以下输出结束:

$ composer install
Loading composer repositories with package information
Installing dependencies (including require-dev) from lock file
Package operations: 1 install, 0 updates, 0 removals
  - Installing psr/log (1.0.0): Downloading (100%)         
Generating autoload files

出于对安装效果的好奇，我重新运行了这个过程，更详细地，以了解 Composer 真正在做什么:

$ rm -Rf vendor/ && composer clearcache && composer install -vvv
Cache directory does not exist (cache-vcs-dir): 
Clearing cache (cache-repo-dir): /tmp/cache/repo
Clearing cache (cache-files-dir): /tmp/cache/files
Clearing cache (cache-dir): /tmp/cache
All caches cleared.
Reading ./composer.json
Loading config file ./composer.json
Checked CA file /etc/ssl/certs/ca-certificates.crt: valid
Executing command (/app): git branch --no-color --no-abbrev -v
Executing command (/app): git describe --exact-match --tags
Executing command (/app): git log --pretty="%H" -n1 HEAD
Executing command (/app): hg branch
Executing command (/app): fossil branch list
Executing command (/app): fossil tag list
Executing command (/app): svn info --xml
Failed to initialize global composer: Composer could not find the config file: /tmp/composer.json
To initialize a project, please create a composer.json file as described in the https://getcomposer.org/ "Getting Started" section
Running 1.8.6 (2019-06-11 15:03:05) with PHP 7.3.8 on Linux / 4.9.184-linuxkit
Reading ./composer.lock
Loading composer repositories with package information
Installing dependencies (including require-dev) from lock file
Reading ./composer.lock
Resolving dependencies through SAT
Looking at all rules.

Dependency resolution completed in 0.000 seconds
Analyzed 43 packages to resolve dependencies
Analyzed 43 rules to resolve dependencies
Package operations: 1 install, 0 updates, 0 removals
Installs: psr/log:1.0.0
  - Installing psr/log (1.0.0): Downloading https://api.github.com/repos/php-fig/log/zipball/a7ab552fdb2efb80aeca09da3bbd9335fc945ff0
Downloading (connecting...)
Following redirect (2) https://codeload.github.com/php-fig/log/legacy.zip/a7ab552fdb2efb80aeca09da3bbd9335fc945ff0
Downloading https://codeload.github.com/php-fig/log/legacy.zip/a7ab552fdb2efb80aeca09da3bbd9335fc945ff0
Downloading (100%)Writing /tmp/cache/files/psr/log/6e79f232da13c50e0fd07e74eb2d58c350e71a60.zip into cache from /app/vendor/psr/log/4ff496e542e24af2efd56eaf051e132b

 Extracting archiveExecuting command (CWD): unzip -qq  '/app/vendor/psr/log/4ff496e542e24af2efd56eaf051e132b' -d '/app/vendor/composer/9c2feb29'
    REASON: Required by the root package: Install command rule (install psr/log 1.0.0)

Generating autoload files

您可以在哪里看到它在提交哈希处安装库 a7ab552fdb2efb80aeca09da3bbd9335fc945ff0 , 信任 composer.lock这样做的指示。

- Installing psr/log (1.0.0): Downloading https://api.github.com/repos/php-fig/log/zipball/a7ab552fdb2efb80aeca09da3bbd9335fc945ff0

有一个问题，因为锁文件说这个提交是版本 1.0.0它提示我它安装了那个版本的软件包，但这是一个小问题。