调用控制台命令安全性：从控制器操作检查产生锁定文件未找到响应

(Symfony3)

I'm toying with the idea of setting up some simple cron tasks to generate security reports for our project managers so that they can schedule upgrade time for developers (vs. me forgetting to run them manually).

As a very basic check, I'll simply run...

php bin/console security:check

...to see what composer has to say about vulnerabilities. Ultimately I'd like to roll this output into an email or post it to a slack channel or basecamp job when the cron is run.

Problem

When I run the command from via terminal it works great. Running the command inside a controller always returns the response Lock file does not exist. I'm assuming this in reference to the composer.lock file at the root of the project. I can confirm that this file does in fact exist.

Following is the controller I'm currently using, which is adapted from this:

http://symfony.com/doc/current/console/command_in_controller.html

<?php

namespace Treetop1500\SecurityReportBundle\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\Controller;
use Symfony\Bundle\FrameworkBundle\Console\Application;
use Symfony\Component\Console\Input\ArrayInput;
use Symfony\Component\Console\Output\BufferedOutput;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Exception\UnauthorizedHttpException;

class DefaultController extends Controller
{
    public function indexAction($key)
    {

        if ($key != $this->getParameter('easy_cron_key')) {
            throw new UnauthorizedHttpException("You are not authorized to access this page.");
        }

        $kernel = $this->get('kernel');
        $application = new Application($kernel);
        $application->setAutoExit(false);

        $input = new ArrayInput(array(
          'command' => 'security:check'
        ));

        // You can use NullOutput() if you don't need the output
        $output = new BufferedOutput();
        $application->run($input, $output);

        // return the output, don't use if you used NullOutput()
        $content = $output->fetch();

        // return new Response(""), if you used NullOutput()
        return new Response($content);

    }
}

$content always has the value "Lock file does not exist."

I realize there are probably better tools and ways to do this, however I would really like to understand why this is the generated response from in this controller action. Thank you for taking a look!

Pass absolute path to composer.lock file just like that:

php bin/console security:check /path/to/another/composer.lock

So in your example, that's would be:

$input = new ArrayInput([
    'command'  => 'security:check',
    'lockfile' => '/path/to/another/composer.lock'
]);

Read more: SecurityCheckerCommand from SensioLabs. Optional argument is lockfile, which is checked by SecurityChecker. On line 46, they are looking for composer.lock file (default argument) and throw an exception, when they not found.

P.S. Earlier, I type the wrong parameters to array. I checked in Symfony documentation (How to Call Other Commands) and fixed the answer.

The solution to this is to pass the lockfile argument to the ArrayInput object like this:

$lockfile = $this->get('kernel')->getRootDir()."/../composer.lock";
$input = new ArrayInput(array('command'=>'security:check','lockfile'=>$lockfile));