Strange error when we try to install propel/propel (2.0.0-alpha10)

UKHESMRD2

Good Morning, we have a strange error when we try to install propel/propel (2.0.0-alpha10) $ /usr/local/bin/security-checker security:check ./composer.lock

But this error was fixed in 2018 -> https://github.com/propelorm/Propel2/pull/1464. Any idea?

Thomas Lehner

are you installing via composer?

UKHESMRD2

yes, via composer update

Thomas Lehner

Just so that we are on the same page. You are using: https://github.com/sensiolabs/security-checker ?

UKHESMRD2

yes

Thomas Lehner

looks to me like a false positive. maybe because the version is not known there yet?

UK6GTK9TL

I think we got a versioning problem here:
Take a look at CVE constraint and semver 🤔

Thomas Lehner

@UK6GTK9TL have you reported this to the propel team?

UK6GTK9TL

No, only here and spryker-support per mail. As far as I know Spryker took the lead on propel development?

Thomas Lehner

Let me check that internally

Thomas Lehner

@UK6GTK9TL could you please share the link to the program that creates the SemVer check?

UK6GTK9TL

do you mean the command?
bin/console security:check composer.lock

CVE database is https://github.com/FriendsOfPHP/security-advisories/tree/master/propel I guess.

Thomas Lehner

thank you, but i meant the Semver check

UK6GTK9TL

for some kind of semver constraint verification I used
https://jubianchi.github.io/semver-check/#/
as you can see in the screenshot above.
Therefore I think the security checker works correctly

Thomas Lehner

thank you

Thomas Lehner

@UK6GTK9TL please take a look here: https://github.com/jubianchi/semver-check/issues/77 a colleague took a look, and it seems that everything works as expected for composer

UK6GTK9TL

thanks for your investigation here!
Funny, if it’s a bug in this semver-checker tool, but on the other hand we do not know how sensions labs resolves constraints.

It looks like the symfony security checker composer.posts lock-file to an endpoint: https://github.com/sensiolabs/security-checker/blob/master/SensioLabs/Security/Crawler.php
Which must handle this also wrong.

We use latest version, can you confirm that security checker evaluates propel 2.0.0-alpha10 to be vulnerable?

Thomas Lehner

@UK6GTK9TL could you PN me your composer.lock please?

Thomas Lehner

thank you. Yes, the security check also evaluates 2.0.0-alpha10 incorrectly for me. Unfortunately, the security checker is a blackbox, so at this point we can only guess that there is a problem with evaluating the versions.

UK6GTK9TL

Thanks for your help, I created an issue on security-checker github project. Perhaps the sensiolab guys can check that internally.

But btw: https://github.com/semver/semver/blob/master/semver.md
suggests dot versions for pre-releases: