mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-23 03:27:02 +09:00
Thomas Vincent
9476a306de
* ci(security): add consolidated Semgrep and Psalm taint gate One workflow runs both taint scanners as separate jobs. Semgrep and Psalm treat htmle()/html_escape()/sanitize_uri() as sanitizers, so findings mean request input reaches a browser sink unescaped. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * stabilize psalm taint analysis * Install dependencies before Psalm analysis * Remove obsolete Psalm taint baseline --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
32 lines
800 B
XML
32 lines
800 B
XML
<?xml version="1.0"?>
|
|
<psalm
|
|
errorLevel="8"
|
|
resolveFromConfigFile="true"
|
|
autoloader="include/vendor/autoload.php"
|
|
errorBaseline="psalm-baseline.xml"
|
|
xmlns="https://getpsalm.org/schema/config"
|
|
>
|
|
<projectFiles>
|
|
<directory name="lib" />
|
|
<directory name="install" />
|
|
<directory name="cli" />
|
|
<directory name="include" />
|
|
<file name="managers.php" />
|
|
<file name="package_import.php" />
|
|
<file name="graphs.php" />
|
|
<file name="host.php" />
|
|
<file name="reports.php" />
|
|
<file name="graph_view.php" />
|
|
<file name="data_sources.php" />
|
|
<file name="aggregate_graphs.php" />
|
|
<ignoreFiles>
|
|
<directory name="include/vendor" />
|
|
<directory name="include/fa" />
|
|
</ignoreFiles>
|
|
</projectFiles>
|
|
|
|
<stubs>
|
|
<file name="build/psalm/cacti-sanitizers.phpstub" />
|
|
</stubs>
|
|
</psalm>
|