本文目录导读：
我来系统地介绍PHP安全自动化方案,包括常见的安全检查点和自动化工具：
核心安全自动化工具
Composer 安全扫描
# 安装安全检查器 composer require --dev enlightn/security-checker # 或使用本地安全顾问 composer audit # 在CI/CD中自动检查 composer install --no-dev --audit
PHP静态分析工具
// phpstan.neon 配置
parameters:
level: max
checkMissingIterableValueType: true
reportUnmatchedIgnoredErrors: false
security:
checkSqlInjection: true
checkXSS: true
checkCommandInjection: true
自动代码审查
# 安装PHP CodeSniffer composer require --dev squizlabs/php_codesniffer # 安全规则集 composer require --dev pheromone/phpcs-security-audit # 自动检查命令 ./vendor/bin/phpcs --standard=Security /path/to/code
自动化安全检查脚本
综合安全检查器
<?php
// security-checker.php
class SecurityAutomation {
private $issues = [];
public function checkFilePermissions() {
$criticalPaths = [
'config/' => '0755',
'storage/logs/' => '0777',
'.env' => '0640',
'vendor/' => '0755'
];
foreach ($criticalPaths as $path => $expected) {
if (file_exists($path)) {
$actual = substr(sprintf('%o', fileperms($path)), -4);
if ($actual !== $expected) {
$this->issues[] = "❌ $path 权限异常：$actual (应为 $expected)";
}
}
}
}
public function checkVulnerablePackages() {
$packages = json_decode(
file_get_contents('composer.lock'),
true
)['packages'] ?? [];
foreach ($packages as $pkg) {
if (isset($pkg['version']) &&
$this->isVersionVulnerable($pkg['name'], $pkg['version'])) {
$this->issues[] = "⚠️ 存在漏洞包: {$pkg['name']} {$pkg['version']}";
}
}
}
public function scanHardcodedSecrets() {
$patterns = [
'/password\s*=\s*["\'][^"\']+["\']/i',
'/api_key\s*=\s*["\'][^"\']+["\']/i',
'/secret\s*=\s*["\'][^"\']+["\']/i',
'/-----BEGIN (RSA|DSA|EC) PRIVATE KEY-----/'
];
$files = $this->getAllPHPFiles();
foreach ($files as $file) {
$content = file_get_contents($file);
foreach ($patterns as $pattern) {
if (preg_match($pattern, $content)) {
$this->issues[] = "🔑 可能包含硬编码密钥: $file";
}
}
}
}
public function checkVulnerableFunctions() {
$dangerous = [
'eval', 'exec', 'system', 'passthru',
'shell_exec', 'popen', 'proc_open',
'unserialize', 'extract', 'parse_str',
'assert', 'create_function'
];
$files = $this->getAllPHPFiles();
foreach ($files as $file) {
$content = file_get_contents($file);
foreach ($dangerous as $func) {
if (preg_match("/\b$func\s*\(/", $content)) {
$this->issues[] = "⚠️ 危险函数使用: $func in $file";
}
}
}
}
private function getAllPHPFiles() {
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator('.')
);
$files = [];
foreach ($iterator as $file) {
if ($file->getExtension() === 'php') {
$files[] = $file->getPathname();
}
}
return $files;
}
public function run() {
echo "🔍 开始安全自动化检查...\n\n";
$this->checkFilePermissions();
$this->checkVulnerablePackages();
$this->scanHardcodedSecrets();
$this->checkVulnerableFunctions();
if (empty($this->issues)) {
echo "✅ 检查通过，未发现安全问题\n";
} else {
echo "发现 " . count($this->issues) . " 个问题:\n\n";
foreach ($this->issues as $issue) {
echo "$issue\n";
}
}
}
}
$checker = new SecurityAutomation();
$checker->run();
自动安全更新脚本
#!/bin/bash # security-update.sh echo "🔐 开始自动安全更新..." # 更新Composer包 composer update --with-all-dependencies # 检查安全漏洞 composer audit # 自动修复已知漏洞 composer security:check # 更新PHP版本（如使用phpenv） phpenv install 8.2.0 phpenv global 8.2.0 # 更新系统包 apt-get update apt-get upgrade -y # 清理旧的session文件 find /tmp -name "sess_*" -type f -mtime +1 -delete echo "✅ 安全更新完成"
CI/CD 安全集成
# .github/workflows/security.yml
name: Security Scan
on:
push:
branches: [ main, develop ]
pull_request:
branches: [ main ]
schedule:
- cron: '0 0 * * 0' # 每周执行
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: '8.2'
tools: composer, phpcs, phpmd
- name: Install dependencies
run: composer install --no-dev --no-interaction
- name: Run Security Checker
run: |
composer audit
vendor/bin/security-checker security:check composer.lock
- name: Static Analysis
run: |
vendor/bin/phpstan analyse src --level=max --no-progress
vendor/bin/psalm --show-info=true
- name: Code Style Check
run: |
vendor/bin/phpcs --standard=PSR12 --extensions=php src/
vendor/bin/phpmd src/ text phpmd.xml
- name: Dependency Vulnerability Scan
uses: snyk/actions/php@master
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
args: --severity-threshold=high
自动预防措施
<?php
// auto-security.php
// 自动XSS过滤
class AutoXSSFilter {
public static function sanitize($input) {
if (is_array($input)) {
return array_map([self::class, 'sanitize'], $input);
}
// 自动HTML实体编码
return htmlspecialchars($input, ENT_QUOTES | ENT_HTML5, 'UTF-8');
}
}
// 自动SQL注入防护
class AutoSQLInjection {
public static function prepareQuery($query, $params) {
// 自动参数化查询
$pdo = new PDO('mysql:host=localhost;dbname=test', 'user', 'pass');
$stmt = $pdo->prepare($query);
$stmt->execute($params);
return $stmt;
}
}
// 自动CSRF保护
class AutoCSRF {
public static function generateToken() {
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
return $_SESSION['csrf_token'];
}
public static function validateToken($token) {
return hash_equals($_SESSION['csrf_token'] ?? '', $token);
}
}
自动化监控脚本
<?php
// security-monitor.php
register_shutdown_function(function() {
$error = error_get_last();
if ($error && in_array($error['type'], [E_ERROR, E_PARSE, E_COMPILE_ERROR])) {
// 自动发送警报
$message = sprintf(
"🚨 安全警报！\n文件: %s\n行号: %d\n错误: %s",
$error['file'],
$error['line'],
$error['message']
);
// 发送邮件/Slack/Webhook
mail('security@example.com', '安全警报', $message);
}
});
最佳实践建议
定期执行的安全任务
# crontab 配置 # 每天检查包更新 0 3 * * * cd /project && composer audit --format=json > /tmp/security-audit.log # 每周完整安全检查 0 4 * * 0 /path/to/security-checker.php > /var/log/security-check.log # 每月清理不必要的文件 0 5 1 * * find /project -name "*.log" -mtime +30 -delete
推荐的工具组合
- 静态分析: PHPStan + Psalm
- 代码质量: PHPCS + PHPMD
- 依赖安全: Composer Audit + Snyk
- 实时监控: 自定义监控脚本
- 自动化部署: CI/CD工具(GitHub Actions/GitLab CI)
核心原则:
- 自动化不能完全替代人工审查
- 保持工具和依赖更新
- 定期检查自动化规则的准确性
- 建立安全响应流程
