PHP Application Analysis

NEW IN RELEASE 86

The Composer coordinate based matching feature provides the ability to scan and evaluate PHP dependencies found in the composer.lock file.

What is supported

Files named composer.lock (a JSON file generated by PHP composer) will be analyzed.

What do we parse from the file?

Only top-level dependencies (specified under the "packages" group) are evaluated, for example:

{
  "packages": [
    {
      "name": "bower-asset/bootstrap",
      "version": "v3.2.0"
    }
}

Steps to analyze using the Nexus IQ CLI

Invoke a Nexus IQ CLI scan of a directory or subdirectories containing a composer.lock file.  Instructions on how to do this can be found here: Nexus IQ CLI.

Example composer.lock file (file is edited for clarity)

{
  "hash": "8ca6b6b80bab36b5287b4292abee988f",
  "packages": [
    {
      "name": "bower-asset/bootstrap",
      "version": "v3.2.0",
      "source": {
        "type": "git",
        "url": "https://github.com/twbs/bootstrap.git",
        "reference": "c068162161154a4b85110ea1e7dd3d7897ce2b72"
      }
    },
	{
      "name": "bower-asset/jquery",
      "version": "2.1.1",
      "source": {
        "type": "git",
        "url": "https://github.com/jquery/jquery.git",
        "reference": "4dec426aa2a6cbabb1b064319ba7c272d594a688"
      }
    },
    {
      "name": "components/jqueryui",
      "version": "1.11.4"
    }
  ]
}

Output from Nexus IQ CLI

Nexus Lifecycle Dashboard Results

Nexus Lifecycle Report Results

Steps to analyze using the Jenkins plugin

By default, the Jenkins plugin will not evaluate the composer.lock file. A custom Scan Target is needed.

nexusPolicyEvaluation iqApplication: 'SampApp', iqScanPatterns: [[scanPattern: '**/composer.lock']], iqStage: 'build'

To find more information on how to configure Jenkins please go to the Nexus Platform Plugin for Jenkins.

Steps to analyze using the Bamboo plugin

Bamboo Scan Targets control what files are examined.  To evaluate PHP, add composer.lock to the scan targets via "**/composer.lock".  To find more information on how to configure Bamboo please go to the Nexus IQ for Bamboo.