snyk 1.932.0 → 1.933.0

package/dist/cli/756.index.js

@@ -156590,9 +156590,11 @@ try {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.nodeFilesToScannedProjects = void 0;
+exports.phpFilesToScannedProjects = exports.nodeFilesToScannedProjects = void 0;
 const node_1 = __webpack_require__(88819);
 Object.defineProperty(exports, "nodeFilesToScannedProjects", ({ enumerable: true, get: function () { return node_1.nodeFilesToScannedProjects; } }));
+const php_1 = __webpack_require__(36609);
+Object.defineProperty(exports, "phpFilesToScannedProjects", ({ enumerable: true, get: function () { return php_1.phpFilesToScannedProjects; } }));
 //# sourceMappingURL=index.js.map
 
 /***/ }),
@@ -156774,7 +156776,7 @@ function unpackJars(jarBuffers, desiredLevelsOfUnpacking, unpackedLevels = 0) {
         // if any of the coords are null for this JAR we didn't manage to get
         // anything from the JAR's pom.properties manifest, so calculate the
         // sha so maven-deps can fallback to searching maven central
-        fingerprints.push(Object.assign({ location: jarInfo.location, digest: jarInfo.coords ? null : buffer_utils_1.bufferToSha1(jarInfo.buffer), dependencies: jarInfo.dependencies }, jarInfo.coords));
+        fingerprints.push(Object.assign({ location: jarInfo.location, digest: jarInfo.coords ? null : (0, buffer_utils_1.bufferToSha1)(jarInfo.buffer), dependencies: jarInfo.dependencies }, jarInfo.coords));
         if (jarInfo.nestedJars.length > 0) {
             // this is an uber/fat JAR so we need to unpack the nested JARs to
             // analyse them for coords and further nested JARs (depth flag allowing)
@@ -156930,6 +156932,80 @@ function stripUndefinedLabels(parserResult) {
 
 /***/ }),
 
+/***/ 36609:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.phpFilesToScannedProjects = void 0;
+const lockFileParser = __webpack_require__(59794);
+const dep_graph_1 = __webpack_require__(71479);
+const path = __webpack_require__(85622);
+const PACKAGE_MANAGER_TYPE = "composer";
+async function phpFilesToScannedProjects(filePathToContent) {
+    const scanResults = [];
+    const filePairs = findManifestLockPairsInSameDirectory(filePathToContent);
+    const shouldIncludeDevDependencies = false;
+    for (const pathPair of filePairs) {
+        const parserResult = await lockFileParser.buildDepTree(filePathToContent[pathPair.lock], filePathToContent[pathPair.manifest], pathPair.manifest, {}, shouldIncludeDevDependencies);
+        const depGraph = await dep_graph_1.legacy.depTreeToGraph(parserResult, PACKAGE_MANAGER_TYPE);
+        const depGraphFact = {
+            type: "depGraph",
+            data: depGraph,
+        };
+        const testedFilesFact = {
+            type: "testedFiles",
+            data: [path.basename(pathPair.manifest), path.basename(pathPair.lock)],
+        };
+        scanResults.push({
+            facts: [depGraphFact, testedFilesFact],
+            identity: {
+                type: depGraph.pkgManager.name,
+                targetFile: pathPair.lock,
+            },
+        });
+    }
+    return scanResults;
+}
+exports.phpFilesToScannedProjects = phpFilesToScannedProjects;
+function findManifestLockPairsInSameDirectory(filePathToContent) {
+    const fileNamesGroupedByDirectory = groupFilesByDirectory(filePathToContent);
+    const manifestLockPathPairs = [];
+    for (const directoryPath of Object.keys(fileNamesGroupedByDirectory)) {
+        const filesInDirectory = fileNamesGroupedByDirectory[directoryPath];
+        if (filesInDirectory.length !== 2) {
+            // either a missing file or too many files, ignore
+            continue;
+        }
+        const hasComposerJson = filesInDirectory.includes("composer.json");
+        const hasComposerLock = filesInDirectory.includes("composer.lock");
+        if (hasComposerJson && hasComposerLock) {
+            manifestLockPathPairs.push({
+                manifest: path.join(directoryPath, "composer.json"),
+                lock: path.join(directoryPath, "composer.lock"),
+            });
+        }
+    }
+    return manifestLockPathPairs;
+}
+// assumption: we only care about manifest+lock files if they are in the same directory
+function groupFilesByDirectory(filePathToContent) {
+    const fileNamesGroupedByDirectory = {};
+    for (const filePath of Object.keys(filePathToContent)) {
+        const directory = path.dirname(filePath);
+        const fileName = path.basename(filePath);
+        if (!fileNamesGroupedByDirectory[directory]) {
+            fileNamesGroupedByDirectory[directory] = [];
+        }
+        fileNamesGroupedByDirectory[directory].push(fileName);
+    }
+    return fileNamesGroupedByDirectory;
+}
+//# sourceMappingURL=php.js.map
+
+/***/ }),
+
 /***/ 91379:
 /***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
@@ -157309,7 +157385,7 @@ async function detect(extractedLayers, dockerfileAnalysis) {
     let hadOsReleaseFile = false;
     let osRelease = null;
     for (const [type, handler] of Object.entries(releaseDetectors)) {
-        const osReleaseFile = os_release_1.getOsReleaseStatic(extractedLayers, type);
+        const osReleaseFile = (0, os_release_1.getOsReleaseStatic)(extractedLayers, type);
         if (!osReleaseFile) {
             continue;
         }
@@ -157595,7 +157671,8 @@ const filePatternStatic = __webpack_require__(89589);
 const static_5 = __webpack_require__(92212);
 const static_6 = __webpack_require__(5809);
 const static_7 = __webpack_require__(96704);
-const static_8 = __webpack_require__(45330);
+const static_8 = __webpack_require__(92578);
+const static_9 = __webpack_require__(45330);
 const option_utils_1 = __webpack_require__(48587);
 const applications_1 = __webpack_require__(19551);
 const java_1 = __webpack_require__(3823);
@@ -157609,7 +157686,7 @@ async function analyze(targetImage, dockerfileAnalysis, imageType, imagePath, gl
         static_1.getApkDbFileContentAction,
         static_2.getDpkgFileContentAction,
         static_2.getExtFileContentAction,
-        static_8.getRpmDbFileContentAction,
+        static_9.getRpmDbFileContentAction,
         ...static_7.getOsReleaseActions,
         static_3.getNodeBinariesFileContentAction,
         static_3.getOpenJDKBinariesFileContentAction,
@@ -157619,21 +157696,22 @@ async function analyze(targetImage, dockerfileAnalysis, imageType, imagePath, gl
     if (checkForGlobs) {
         staticAnalysisActions.push(filePatternStatic.generateExtractAction(globsToFind.include, globsToFind.exclude));
     }
-    const appScan = option_utils_1.isTrue(options["app-vulns"]);
+    const appScan = (0, option_utils_1.isTrue)(options["app-vulns"]);
     if (appScan) {
         staticAnalysisActions.push(...[
             static_6.getNodeAppFileContentAction,
+            static_8.getPhpAppFileContentAction,
             static_5.getJarFileContentAction,
             go_parser_1.getGoModulesContentAction,
         ]);
     }
     const { imageId, manifestLayers, extractedLayers, rootFsLayers, autoDetectedUserInstructions, platform, imageLabels, imageCreationTime, } = await archiveExtractor.extractImageContent(imageType, imagePath, staticAnalysisActions);
     const [apkDbFileContent, aptDbFileContent, rpmDbFileContent,] = await Promise.all([
-        static_1.getApkDbFileContent(extractedLayers),
-        static_2.getAptDbFileContent(extractedLayers),
-        static_8.getRpmDbFileContent(extractedLayers),
+        (0, static_1.getApkDbFileContent)(extractedLayers),
+        (0, static_2.getAptDbFileContent)(extractedLayers),
+        (0, static_9.getRpmDbFileContent)(extractedLayers),
     ]);
-    const distrolessAptFiles = static_4.getAptFiles(extractedLayers);
+    const distrolessAptFiles = (0, static_4.getAptFiles)(extractedLayers);
     const manifestFiles = [];
     if (checkForGlobs) {
         const matchingFiles = filePatternStatic.getMatchingFiles(extractedLayers);
@@ -157650,24 +157728,25 @@ async function analyze(targetImage, dockerfileAnalysis, imageType, imagePath, gl
     let results;
     try {
         results = await Promise.all([
-            apk_1.analyze(targetImage, apkDbFileContent),
-            apt_1.analyze(targetImage, aptDbFileContent),
-            rpm_1.analyze(targetImage, rpmDbFileContent),
-            apt_1.analyzeDistroless(targetImage, distrolessAptFiles),
+            (0, apk_1.analyze)(targetImage, apkDbFileContent),
+            (0, apt_1.analyze)(targetImage, aptDbFileContent),
+            (0, rpm_1.analyze)(targetImage, rpmDbFileContent),
+            (0, apt_1.analyzeDistroless)(targetImage, distrolessAptFiles),
         ]);
     }
     catch (err) {
         debug(`Could not detect installed OS packages: ${JSON.stringify(err)}`);
         throw new Error("Failed to detect installed OS packages");
     }
-    const binaries = static_3.getBinariesHashes(extractedLayers);
+    const binaries = (0, static_3.getBinariesHashes)(extractedLayers);
     const applicationDependenciesScanResults = [];
     if (appScan) {
-        const nodeDependenciesScanResults = await applications_1.nodeFilesToScannedProjects(inputs_1.getFileContent(extractedLayers, static_6.getNodeAppFileContentAction.actionName));
+        const nodeDependenciesScanResults = await (0, applications_1.nodeFilesToScannedProjects)((0, inputs_1.getFileContent)(extractedLayers, static_6.getNodeAppFileContentAction.actionName));
+        const phpDependenciesScanResults = await (0, applications_1.phpFilesToScannedProjects)((0, inputs_1.getFileContent)(extractedLayers, static_8.getPhpAppFileContentAction.actionName));
         const desiredLevelsOfUnpacking = getNestedJarsDesiredDepth(options);
-        const jarFingerprintScanResults = await java_1.jarFilesToScannedProjects(inputs_1.getBufferContent(extractedLayers, static_5.getJarFileContentAction.actionName), targetImage, desiredLevelsOfUnpacking);
-        const goModulesScanResult = await go_parser_1.goModulesToScannedProjects(inputs_1.getElfFileContent(extractedLayers, go_parser_1.getGoModulesContentAction.actionName));
-        applicationDependenciesScanResults.push(...nodeDependenciesScanResults, ...jarFingerprintScanResults, ...goModulesScanResult);
+        const jarFingerprintScanResults = await (0, java_1.jarFilesToScannedProjects)((0, inputs_1.getBufferContent)(extractedLayers, static_5.getJarFileContentAction.actionName), targetImage, desiredLevelsOfUnpacking);
+        const goModulesScanResult = await (0, go_parser_1.goModulesToScannedProjects)((0, inputs_1.getElfFileContent)(extractedLayers, go_parser_1.getGoModulesContentAction.actionName));
+        applicationDependenciesScanResults.push(...nodeDependenciesScanResults, ...phpDependenciesScanResults, ...jarFingerprintScanResults, ...goModulesScanResult);
     }
     return {
         imageId,
@@ -158043,7 +158122,7 @@ function formatMetadataLine(header, info = "") {
 }
 function formatSummary(testResult) {
     var _a;
-    const depGraph = dep_graph_1.createFromJSON(testResult.depGraphData);
+    const depGraph = (0, dep_graph_1.createFromJSON)(testResult.depGraphData);
     const pkgCount = ((_a = depGraph === null || depGraph === void 0 ? void 0 : depGraph.getDepPkgs()) === null || _a === void 0 ? void 0 : _a.length) || 0;
     const pathOrDepsText = `${pkgCount} dependencies`;
     const testedInfoText = `Tested ${pathOrDepsText} for known issues`;
@@ -158214,7 +158293,7 @@ class Docker {
                 if (err) {
                     return reject(err);
                 }
-                const writeStream = fs_1.createWriteStream(destination);
+                const writeStream = (0, fs_1.createWriteStream)(destination);
                 writeStream.on("error", (err) => {
                     reject(err);
                 });
@@ -158260,15 +158339,15 @@ async function readDockerfileAndAnalyse(dockerfilePath) {
     if (!dockerfilePath) {
         return undefined;
     }
-    const contents = await readFile(path_1.normalize(dockerfilePath));
+    const contents = await readFile((0, path_1.normalize)(dockerfilePath));
     return analyseDockerfile(contents);
 }
 exports.readDockerfileAndAnalyse = readDockerfileAndAnalyse;
 async function analyseDockerfile(contents) {
     const dockerfile = dockerfile_ast_1.DockerfileParser.parse(contents);
-    const baseImageResult = instruction_parser_1.getDockerfileBaseImageName(dockerfile);
-    const dockerfilePackages = instruction_parser_1.getPackagesFromDockerfile(dockerfile);
-    const dockerfileLayers = instruction_parser_1.getLayersFromPackages(dockerfilePackages);
+    const baseImageResult = (0, instruction_parser_1.getDockerfileBaseImageName)(dockerfile);
+    const dockerfilePackages = (0, instruction_parser_1.getPackagesFromDockerfile)(dockerfile);
+    const dockerfileLayers = (0, instruction_parser_1.getLayersFromPackages)(dockerfilePackages);
     return {
         baseImage: baseImageResult.baseImage,
         dockerfilePackages,
@@ -158481,7 +158560,7 @@ const types_1 = __webpack_require__(13939);
  */
 function updateDockerfileBaseImageName(contents, newBaseImageName) {
     const dockerfile = dockerfile_ast_1.DockerfileParser.parse(contents);
-    const result = instruction_parser_1.getDockerfileBaseImageName(dockerfile);
+    const result = (0, instruction_parser_1.getDockerfileBaseImageName)(dockerfile);
     if (result.error) {
         return {
             contents,
@@ -158586,7 +158665,7 @@ async function applyCallbacks(matchedActions, fileContentStream, streamSize) {
         const promise = action.callback !== undefined
             ? action.callback(streamCopy, streamSize)
             : // If no callback was provided for this action then return as string by default.
-                stream_utils_1.streamToString(streamCopy);
+                (0, stream_utils_1.streamToString)(streamCopy);
         return promise.then((content) => {
             // Assign the result once the Promise is complete.
             if (content) {
@@ -158619,7 +158698,7 @@ const types_1 = __webpack_require__(93677);
 var layer_1 = __webpack_require__(71544);
 Object.defineProperty(exports, "extractArchive", ({ enumerable: true, get: function () { return layer_1.extractArchive; } }));
 function getManifestLayers(manifest) {
-    return manifest.Layers.map((layer) => path_1.normalize(layer));
+    return manifest.Layers.map((layer) => (0, path_1.normalize)(layer));
 }
 exports.getManifestLayers = getManifestLayers;
 function getImageIdFromManifest(manifest) {
@@ -158655,8 +158734,8 @@ function getDetectedLayersInfoFromConfig(imageConfig) {
     const runInstructions = getUserInstructionLayersFromConfig(imageConfig)
         .filter((instruction) => !instruction.empty_layer && instruction.created_by)
         .map((instruction) => instruction.created_by.replace("# buildkit", ""));
-    const dockerfilePackages = instruction_parser_1.getPackagesFromRunInstructions(runInstructions);
-    const dockerfileLayers = instruction_parser_1.getLayersFromPackages(dockerfilePackages);
+    const dockerfilePackages = (0, instruction_parser_1.getPackagesFromRunInstructions)(runInstructions);
+    const dockerfileLayers = (0, instruction_parser_1.getLayersFromPackages)(dockerfilePackages);
     return { dockerfilePackages, dockerfileLayers };
 }
 exports.getDetectedLayersInfoFromConfig = getDetectedLayersInfoFromConfig;
@@ -158706,16 +158785,16 @@ const debug = Debug("snyk");
  */
 async function extractArchive(dockerArchiveFilesystemPath, extractActions) {
     return new Promise((resolve, reject) => {
-        const tarExtractor = tar_stream_1.extract();
+        const tarExtractor = (0, tar_stream_1.extract)();
         const layers = {};
         let manifest;
         let imageConfig;
         tarExtractor.on("entry", async (header, stream, next) => {
             if (header.type === "file") {
-                const normalizedName = path_1.normalize(header.name);
+                const normalizedName = (0, path_1.normalize)(header.name);
                 if (isTarFile(normalizedName)) {
                     try {
-                        layers[normalizedName] = await layer_1.extractImageLayer(stream, extractActions);
+                        layers[normalizedName] = await (0, layer_1.extractImageLayer)(stream, extractActions);
                     }
                     catch (error) {
                         debug(`Error extracting layer content from: '${error}'`);
@@ -158743,7 +158822,7 @@ async function extractArchive(dockerArchiveFilesystemPath, extractActions) {
             }
         });
         tarExtractor.on("error", (error) => reject(error));
-        fs_1.createReadStream(dockerArchiveFilesystemPath)
+        (0, fs_1.createReadStream)(dockerArchiveFilesystemPath)
             .pipe(gunzip())
             .pipe(tarExtractor);
     });
@@ -158753,7 +158832,7 @@ function getLayersContentAndArchiveManifest(manifest, imageConfig, layers) {
     // skip (ignore) non-existent layers
     // get the layers content without the name
     // reverse layers order from last to first
-    const layersWithNormalizedNames = manifest.Layers.map((layersName) => path_1.normalize(layersName));
+    const layersWithNormalizedNames = manifest.Layers.map((layersName) => (0, path_1.normalize)(layersName));
     const filteredLayers = layersWithNormalizedNames
         .filter((layersName) => layers[layersName])
         .map((layerName) => layers[layerName])
@@ -158771,7 +158850,7 @@ function getLayersContentAndArchiveManifest(manifest, imageConfig, layers) {
  * Note: consumes the stream.
  */
 async function getManifestFile(stream) {
-    return stream_utils_1.streamToJson(stream);
+    return (0, stream_utils_1.streamToJson)(stream);
 }
 function isManifestFile(name) {
     return name === "manifest.json";
@@ -158784,7 +158863,7 @@ function isTarFile(name) {
     // For both "docker save" and "skopeo copy" style archives the
     // layers are represented as tar archives whose names end in .tar.
     // For Docker this is "layer.tar", for Skopeo - "<sha256ofLayer>.tar".
-    return path_1.basename(name).endsWith(".tar");
+    return (0, path_1.basename)(name).endsWith(".tar");
 }
 //# sourceMappingURL=layer.js.map
 
@@ -158899,15 +158978,15 @@ const debug = Debug("snyk");
 async function extractImageLayer(layerTarStream, extractActions) {
     return new Promise((resolve, reject) => {
         const result = {};
-        const tarExtractor = tar_stream_1.extract();
+        const tarExtractor = (0, tar_stream_1.extract)();
         tarExtractor.on("entry", async (headers, stream, next) => {
             if (headers.type === "file") {
                 const absoluteFileName = path.join(path.sep, headers.name);
                 const matchedActions = extractActions.filter((action) => action.filePathMatches(absoluteFileName));
                 if (matchedActions.length > 0) {
                     try {
-                        const callbackResult = await callbacks_1.applyCallbacks(matchedActions, stream, headers.size);
-                        if (!callbacks_1.isResultEmpty(callbackResult)) {
+                        const callbackResult = await (0, callbacks_1.applyCallbacks)(matchedActions, stream, headers.size);
+                        if (!(0, callbacks_1.isResultEmpty)(callbackResult)) {
                             result[absoluteFileName] = callbackResult;
                         }
                     }
@@ -158984,16 +159063,16 @@ const debug = Debug("snyk");
  */
 async function extractArchive(ociArchiveFilesystemPath, extractActions) {
     return new Promise((resolve, reject) => {
-        const tarExtractor = tar_stream_1.extract();
+        const tarExtractor = (0, tar_stream_1.extract)();
         const layers = {};
         const manifests = {};
         let imageConfig;
         let imageIndex;
         tarExtractor.on("entry", async (header, stream, next) => {
             if (header.type === "file") {
-                const normalizedHeaderName = path_1.normalize(header.name);
+                const normalizedHeaderName = (0, path_1.normalize)(header.name);
                 if (isImageIndexFile(normalizedHeaderName)) {
-                    imageIndex = await stream_utils_1.streamToJson(stream);
+                    imageIndex = await (0, stream_utils_1.streamToJson)(stream);
                 }
                 else {
                     const jsonStream = new stream_1.PassThrough();
@@ -159001,8 +159080,8 @@ async function extractArchive(ociArchiveFilesystemPath, extractActions) {
                     stream.pipe(jsonStream);
                     stream.pipe(layerStream);
                     const promises = [
-                        stream_utils_1.streamToJson(jsonStream).catch(() => undefined),
-                        layer_1.extractImageLayer(layerStream, extractActions).catch(() => undefined),
+                        (0, stream_utils_1.streamToJson)(jsonStream).catch(() => undefined),
+                        (0, layer_1.extractImageLayer)(layerStream, extractActions).catch(() => undefined),
                     ];
                     const [manifest, layer] = await Promise.all(promises);
                     // header format is /blobs/hash_name/hash_value
@@ -159037,7 +159116,7 @@ async function extractArchive(ociArchiveFilesystemPath, extractActions) {
         tarExtractor.on("error", (error) => {
             reject(error);
         });
-        fs_1.createReadStream(ociArchiveFilesystemPath)
+        (0, fs_1.createReadStream)(ociArchiveFilesystemPath)
             .pipe(gunzip())
             .pipe(tarExtractor);
     });
@@ -159151,7 +159230,7 @@ async function findGoBinaries(stream, streamSize) {
             try {
                 // Discard
                 if (bytesWritten === 0) {
-                    return resolve();
+                    return resolve(undefined);
                 }
                 const binaryFile = elf.parse(buffer);
                 const goBuildInfo = binaryFile.body.sections.find((section) => section.name === ".go.buildinfo");
@@ -159159,13 +159238,13 @@ async function findGoBinaries(stream, streamSize) {
                 const goBuildId = binaryFile.body.sections.find((section) => section.name === ".note.go.buildid");
                 const interp = binaryFile.body.sections.find((section) => section.name === ".interp");
                 if (!goBuildInfo && !goBuildId) {
-                    return resolve();
+                    return resolve(undefined);
                 }
                 else if (interp) {
                     // Compiled using cgo
                     // we wouldn't be able to extract modules
                     // TODO: cgo-compiled binaries are not supported in this iteration
-                    return resolve();
+                    return resolve(undefined);
                 }
                 else if (goBuildInfo) {
                     const info = goBuildInfo.data
@@ -159174,7 +159253,7 @@ async function findGoBinaries(stream, streamSize) {
                     if (info === buildInfoMagic) {
                         return resolve(binaryFile);
                     }
-                    return resolve();
+                    return resolve(undefined);
                 }
                 else if (goBuildId) {
                     const strings = goBuildId.data
@@ -159189,13 +159268,13 @@ async function findGoBinaries(stream, streamSize) {
                     if (go === buildIdMagic && buildIdParts.length >= 2) {
                         return resolve(binaryFile);
                     }
-                    return resolve();
+                    return resolve(undefined);
                 }
             }
             catch (error) {
                 // catching exception during elf file parse shouldn't fail the archive iteration
                 // it either we recognize file as binary or not
-                return resolve();
+                return resolve(undefined);
             }
         });
         stream.on("error", (error) => {
@@ -159225,7 +159304,7 @@ async function goModulesToScannedProjects(filePathToContent) {
         if (event_loop_spinner_1.eventLoopSpinner.isStarving()) {
             await event_loop_spinner_1.eventLoopSpinner.spin();
         }
-        const depGraph = await parser_1.parseGoBinary(goBinary);
+        const depGraph = await (0, parser_1.parseGoBinary)(goBinary);
         if (!depGraph) {
             continue;
         }
@@ -159273,8 +159352,8 @@ async function parseGoBinary(goBinary) {
     if (!strTab) {
         return undefined;
     }
-    const { name, modules } = version_parser_1.extractModulesFromBinary(goBinary);
-    const packages = str_tab_parser_1.parserStrTab(strTab.data);
+    const { name, modules } = (0, version_parser_1.extractModulesFromBinary)(goBinary);
+    const packages = (0, str_tab_parser_1.parserStrTab)(strTab.data);
     // If there is no packages or modules, return empty result
     if (Object.keys(modules).length === 0 || packages.length === 0) {
         return undefined;
@@ -159552,7 +159631,7 @@ function fullImageSavePath(imageSavePath) {
     if (imageSavePath) {
         imagePath = path.normalize(imageSavePath);
     }
-    return path.join(imagePath, uuid_1.v4());
+    return path.join(imagePath, (0, uuid_1.v4)());
 }
 exports.fullImageSavePath = fullImageSavePath;
 //# sourceMappingURL=image-save-path.js.map
@@ -159586,8 +159665,8 @@ function getArchivePath(targetImage) {
         throw new Error('The provided archive path is missing a prefix, for example "docker-archive:" or "oci-archive:"');
     }
     return targetImage.indexOf("docker-archive:") !== -1
-        ? path_1.normalize(targetImage.substring("docker-archive:".length))
-        : path_1.normalize(targetImage.substring("oci-archive:".length));
+        ? (0, path_1.normalize)(targetImage.substring("docker-archive:".length))
+        : (0, path_1.normalize)(targetImage.substring("oci-archive:".length));
 }
 exports.getArchivePath = getArchivePath;
 //# sourceMappingURL=image-type.js.map
@@ -159631,11 +159710,11 @@ const extractor_1 = __webpack_require__(18141);
 const stream_utils_1 = __webpack_require__(54540);
 exports.getApkDbFileContentAction = {
     actionName: "apk-db",
-    filePathMatches: (filePath) => filePath === path_1.normalize("/lib/apk/db/installed"),
+    filePathMatches: (filePath) => filePath === (0, path_1.normalize)("/lib/apk/db/installed"),
     callback: stream_utils_1.streamToString,
 };
 function getApkDbFileContent(extractedLayers) {
-    const apkDb = extractor_1.getContentAsString(extractedLayers, exports.getApkDbFileContentAction);
+    const apkDb = (0, extractor_1.getContentAsString)(extractedLayers, exports.getApkDbFileContentAction);
     return apkDb || "";
 }
 exports.getApkDbFileContent = getApkDbFileContent;
@@ -159655,18 +159734,18 @@ const extractor_1 = __webpack_require__(18141);
 const stream_utils_1 = __webpack_require__(54540);
 exports.getDpkgFileContentAction = {
     actionName: "dpkg",
-    filePathMatches: (filePath) => filePath === path_1.normalize("/var/lib/dpkg/status"),
+    filePathMatches: (filePath) => filePath === (0, path_1.normalize)("/var/lib/dpkg/status"),
     callback: stream_utils_1.streamToString,
 };
 exports.getExtFileContentAction = {
     actionName: "ext",
-    filePathMatches: (filePath) => filePath === path_1.normalize("/var/lib/apt/extended_states"),
+    filePathMatches: (filePath) => filePath === (0, path_1.normalize)("/var/lib/apt/extended_states"),
     callback: stream_utils_1.streamToString,
 };
 function getAptDbFileContent(extractedLayers) {
-    const dpkgContent = extractor_1.getContentAsString(extractedLayers, exports.getDpkgFileContentAction);
+    const dpkgContent = (0, extractor_1.getContentAsString)(extractedLayers, exports.getDpkgFileContentAction);
     const dpkgFile = dpkgContent || "";
-    const extContent = extractor_1.getContentAsString(extractedLayers, exports.getExtFileContentAction);
+    const extContent = (0, extractor_1.getContentAsString)(extractedLayers, exports.getExtFileContentAction);
     const extFile = extContent || "";
     return {
         dpkgFile,
@@ -159733,8 +159812,8 @@ const path_1 = __webpack_require__(85622);
 const stream_utils_1 = __webpack_require__(54540);
 exports.getDpkgPackageFileContentAction = {
     actionName: "dpkg",
-    filePathMatches: (filePath) => filePath.startsWith(path_1.normalize("/var/lib/dpkg/status.d/")),
-    callback: stream_utils_1.streamToString,
+    filePathMatches: (filePath) => filePath.startsWith((0, path_1.normalize)("/var/lib/dpkg/status.d/")),
+    callback: stream_utils_1.streamToString, // TODO replace with a parser for apt data extractor
 };
 function getAptFiles(extractedLayers) {
     const files = [];
@@ -159783,7 +159862,7 @@ function generateExtractAction(globsInclude, globsExclude) {
     return {
         actionName: "find-files-by-pattern",
         filePathMatches: generatePathMatcher(globsInclude, globsExclude),
-        callback: (dataStream, streamSize) => stream_utils_1.streamToString(dataStream, streamSize, "base64"),
+        callback: (dataStream, streamSize) => (0, stream_utils_1.streamToString)(dataStream, streamSize, "base64"),
     };
 }
 exports.generateExtractAction = generateExtractAction;
@@ -159916,7 +159995,7 @@ const path_1 = __webpack_require__(85622);
 const stream_utils_1 = __webpack_require__(54540);
 const nodeAppFiles = ["package.json", "package-lock.json", "yarn.lock"];
 function filePathMatches(filePath) {
-    const fileName = path_1.basename(filePath);
+    const fileName = (0, path_1.basename)(filePath);
     return (filePath.indexOf("node_modules") === -1 && nodeAppFiles.includes(fileName));
 }
 exports.getNodeAppFileContentAction = {
@@ -159954,42 +160033,42 @@ const stream_utils_1 = __webpack_require__(54540);
 const types_1 = __webpack_require__(93677);
 const getOsReleaseAction = {
     actionName: "os-release",
-    filePathMatches: (filePath) => filePath === path_1.normalize(types_1.OsReleaseFilePath.Linux),
+    filePathMatches: (filePath) => filePath === (0, path_1.normalize)(types_1.OsReleaseFilePath.Linux),
     callback: stream_utils_1.streamToString,
 };
 const getFallbackOsReleaseAction = {
     actionName: "os-release-fallback",
-    filePathMatches: (filePath) => filePath === path_1.normalize(types_1.OsReleaseFilePath.LinuxFallback),
+    filePathMatches: (filePath) => filePath === (0, path_1.normalize)(types_1.OsReleaseFilePath.LinuxFallback),
     callback: stream_utils_1.streamToString,
 };
 const getLsbReleaseAction = {
     actionName: "lsb-release",
-    filePathMatches: (filePath) => filePath === path_1.normalize(types_1.OsReleaseFilePath.Lsb),
+    filePathMatches: (filePath) => filePath === (0, path_1.normalize)(types_1.OsReleaseFilePath.Lsb),
     callback: stream_utils_1.streamToString,
 };
 const getDebianVersionAction = {
     actionName: "debian-version",
-    filePathMatches: (filePath) => filePath === path_1.normalize(types_1.OsReleaseFilePath.Debian),
+    filePathMatches: (filePath) => filePath === (0, path_1.normalize)(types_1.OsReleaseFilePath.Debian),
     callback: stream_utils_1.streamToString,
 };
 const getAlpineReleaseAction = {
     actionName: "alpine-release",
-    filePathMatches: (filePath) => filePath === path_1.normalize(types_1.OsReleaseFilePath.Alpine),
+    filePathMatches: (filePath) => filePath === (0, path_1.normalize)(types_1.OsReleaseFilePath.Alpine),
     callback: stream_utils_1.streamToString,
 };
 const getRedHatReleaseAction = {
     actionName: "redhat-release",
-    filePathMatches: (filePath) => filePath === path_1.normalize(types_1.OsReleaseFilePath.RedHat),
+    filePathMatches: (filePath) => filePath === (0, path_1.normalize)(types_1.OsReleaseFilePath.RedHat),
     callback: stream_utils_1.streamToString,
 };
 const getCentosReleaseAction = {
     actionName: "centos-release",
-    filePathMatches: (filePath) => filePath === path_1.normalize(types_1.OsReleaseFilePath.Centos),
+    filePathMatches: (filePath) => filePath === (0, path_1.normalize)(types_1.OsReleaseFilePath.Centos),
     callback: stream_utils_1.streamToString,
 };
 const getOracleReleaseAction = {
     actionName: "oracle-release",
-    filePathMatches: (filePath) => filePath === path_1.normalize(types_1.OsReleaseFilePath.Oracle),
+    filePathMatches: (filePath) => filePath === (0, path_1.normalize)(types_1.OsReleaseFilePath.Oracle),
     callback: stream_utils_1.streamToString,
 };
 const osReleaseActionMap = {
@@ -160013,7 +160092,7 @@ exports.getOsReleaseActions = [
     getOracleReleaseAction,
 ];
 function getOsRelease(extractedLayers, releasePath) {
-    const osRelease = extractor_1.getContentAsString(extractedLayers, osReleaseActionMap[releasePath]);
+    const osRelease = (0, extractor_1.getContentAsString)(extractedLayers, osReleaseActionMap[releasePath]);
     return osRelease || "";
 }
 exports.getOsRelease = getOsRelease;
@@ -160021,6 +160100,29 @@ exports.getOsRelease = getOsRelease;
 
 /***/ }),
 
+/***/ 92578:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getPhpAppFileContentAction = void 0;
+const path_1 = __webpack_require__(85622);
+const stream_utils_1 = __webpack_require__(54540);
+const phpAppFiles = ["composer.json", "composer.lock"];
+function filePathMatches(filePath) {
+    const fileName = (0, path_1.basename)(filePath);
+    return phpAppFiles.includes(fileName);
+}
+exports.getPhpAppFileContentAction = {
+    actionName: "php-app-files",
+    filePathMatches,
+    callback: stream_utils_1.streamToString,
+};
+//# sourceMappingURL=static.js.map
+
+/***/ }),
+
 /***/ 45330:
 /***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
@@ -160036,17 +160138,17 @@ const stream_utils_1 = __webpack_require__(54540);
 const debug = Debug("snyk");
 exports.getRpmDbFileContentAction = {
     actionName: "rpm-db",
-    filePathMatches: (filePath) => filePath === path_1.normalize("/var/lib/rpm/Packages") ||
-        filePath === path_1.normalize("/usr/lib/sysimage/rpm/Packages"),
+    filePathMatches: (filePath) => filePath === (0, path_1.normalize)("/var/lib/rpm/Packages") ||
+        filePath === (0, path_1.normalize)("/usr/lib/sysimage/rpm/Packages"),
     callback: stream_utils_1.streamToBuffer,
 };
 async function getRpmDbFileContent(extractedLayers) {
-    const rpmDb = extractor_1.getContentAsBuffer(extractedLayers, exports.getRpmDbFileContentAction);
+    const rpmDb = (0, extractor_1.getContentAsBuffer)(extractedLayers, exports.getRpmDbFileContentAction);
     if (!rpmDb) {
         return "";
     }
     try {
-        const parserResponse = await rpm_parser_1.getPackages(rpmDb);
+        const parserResponse = await (0, rpm_parser_1.getPackages)(rpmDb);
         if (parserResponse.error !== undefined) {
             throw parserResponse.error;
         }
@@ -160328,7 +160430,7 @@ function annotateLayerIds(deps, dockerfilePkgs) {
         const pkg = deps[dep];
         const dockerfilePkg = dockerfilePkgs[dep];
         if (dockerfilePkg) {
-            pkg.labels = Object.assign(Object.assign({}, (pkg.labels || {})), { dockerLayerId: dockerfile_1.instructionDigest(dockerfilePkg.instruction) });
+            pkg.labels = Object.assign(Object.assign({}, (pkg.labels || {})), { dockerLayerId: (0, dockerfile_1.instructionDigest)(dockerfilePkg.instruction) });
         }
         if (pkg.dependencies) {
             annotateLayerIds(pkg.dependencies, dockerfilePkgs);
@@ -160370,20 +160472,24 @@ async function scan(options) {
         throw new Error("No image identifier or path provided");
     }
     const nestedJarsDepth = options["nested-jars-depth"] || options["shaded-jars-depth"];
-    if ((option_utils_1.isTrue(nestedJarsDepth) || option_utils_1.isNumber(nestedJarsDepth)) &&
-        !option_utils_1.isTrue(options["app-vulns"])) {
+    if (((0, option_utils_1.isTrue)(nestedJarsDepth) || (0, option_utils_1.isNumber)(nestedJarsDepth)) &&
+        !(0, option_utils_1.isTrue)(options["app-vulns"])) {
         throw new Error("To use --nested-jars-depth, you must also use --app-vulns");
     }
-    if ((!option_utils_1.isNumber(nestedJarsDepth) &&
-        !option_utils_1.isTrue(nestedJarsDepth) &&
+    if ((!(0, option_utils_1.isNumber)(nestedJarsDepth) &&
+        !(0, option_utils_1.isTrue)(nestedJarsDepth) &&
         typeof nestedJarsDepth !== "undefined") ||
         Number(nestedJarsDepth) < 0) {
         throw new Error("--nested-jars-depth accepts only numbers bigger than or equal to 0");
     }
+    // TODO temporary solution to avoid double results for PHP if exists in `globsToFind`
+    if (options.globsToFind) {
+        options.globsToFind.include = options.globsToFind.include.filter((glob) => !glob.includes("composer"));
+    }
     const targetImage = appendLatestTagIfMissing(options.path);
     const dockerfilePath = options.file;
-    const dockerfileAnalysis = await dockerfile_1.readDockerfileAndAnalyse(dockerfilePath);
-    const imageType = image_type_1.getImageType(targetImage);
+    const dockerfileAnalysis = await (0, dockerfile_1.readDockerfileAndAnalyse)(dockerfilePath);
+    const imageType = (0, image_type_1.getImageType)(targetImage);
     switch (imageType) {
         case types_1.ImageType.DockerArchive:
         case types_1.ImageType.OciArchive:
@@ -160401,7 +160507,7 @@ async function localArchiveAnalysis(targetImage, imageType, dockerfileAnalysis,
         include: ((_a = options.globsToFind) === null || _a === void 0 ? void 0 : _a.include) || [],
         exclude: ((_b = options.globsToFind) === null || _b === void 0 ? void 0 : _b.exclude) || [],
     };
-    const archivePath = image_type_1.getArchivePath(targetImage);
+    const archivePath = (0, image_type_1.getArchivePath)(targetImage);
     if (!fs.existsSync(archivePath)) {
         throw new Error("The provided archive path does not exist on the filesystem");
     }
@@ -160419,8 +160525,8 @@ async function imageIdentifierAnalysis(targetImage, imageType, dockerfileAnalysi
         include: ((_a = options.globsToFind) === null || _a === void 0 ? void 0 : _a.include) || [],
         exclude: ((_b = options.globsToFind) === null || _b === void 0 ? void 0 : _b.exclude) || [],
     };
-    const imageSavePath = image_save_path_1.fullImageSavePath(options.imageSavePath);
-    const archiveResult = await image_inspector_1.getImageArchive(targetImage, imageSavePath, options.username, options.password, options.platform);
+    const imageSavePath = (0, image_save_path_1.fullImageSavePath)(options.imageSavePath);
+    const archiveResult = await (0, image_inspector_1.getImageArchive)(targetImage, imageSavePath, options.username, options.password, options.platform);
     const imagePath = archiveResult.path;
     try {
         return await staticModule.analyzeStatically(targetImage, dockerfileAnalysis, imageType, imagePath, globToFind, options);
@@ -160430,7 +160536,7 @@ async function imageIdentifierAnalysis(targetImage, imageType, dockerfileAnalysi
     }
 }
 function appendLatestTagIfMissing(targetImage) {
-    if (image_type_1.getImageType(targetImage) === types_1.ImageType.Identifier &&
+    if ((0, image_type_1.getImageType)(targetImage) === types_1.ImageType.Identifier &&
         !targetImage.includes(":")) {
         return `${targetImage}:latest`;
     }
@@ -160455,12 +160561,12 @@ const parser_1 = __webpack_require__(45062);
 const response_builder_1 = __webpack_require__(75319);
 async function analyzeStatically(targetImage, dockerfileAnalysis, imageType, imagePath, globsToFind, options) {
     const staticAnalysis = await analyzer.analyzeStatically(targetImage, dockerfileAnalysis, imageType, imagePath, globsToFind, options);
-    const parsedAnalysisResult = parser_1.parseAnalysisResults(targetImage, staticAnalysis);
+    const parsedAnalysisResult = (0, parser_1.parseAnalysisResults)(targetImage, staticAnalysis);
     /** @deprecated Should try to build a dependency graph instead. */
-    const dependenciesTree = await dependency_tree_1.buildTree(targetImage, parsedAnalysisResult.type, parsedAnalysisResult.depInfosList, parsedAnalysisResult.targetOS);
+    const dependenciesTree = await (0, dependency_tree_1.buildTree)(targetImage, parsedAnalysisResult.type, parsedAnalysisResult.depInfosList, parsedAnalysisResult.targetOS);
     const analysis = Object.assign(Object.assign({}, staticAnalysis), { depTree: dependenciesTree, imageId: parsedAnalysisResult.imageId, imageLayers: parsedAnalysisResult.imageLayers, packageManager: parsedAnalysisResult.type });
-    const excludeBaseImageVulns = option_utils_1.isTrue(options["exclude-base-image-vulns"]);
-    return response_builder_1.buildResponse(analysis, dockerfileAnalysis, excludeBaseImageVulns);
+    const excludeBaseImageVulns = (0, option_utils_1.isTrue)(options["exclude-base-image-vulns"]);
+    return (0, response_builder_1.buildResponse)(analysis, dockerfileAnalysis, excludeBaseImageVulns);
 }
 exports.analyzeStatically = analyzeStatically;
 //# sourceMappingURL=static.js.map