Signatures for the Symfony Process component

[chrisdeeming]

The Antimalware Scanner would detect the existence of the Symfony Process component as it makes extensive use of the exec proc_* and posix functions but one thing the scanner doesn't account for is if the environment - by design - already includes that component but the code we're scanning may be attempting to use it which may have undesirable effects.

"Don't have the Symfony Process component in your environment" seems like a sensible solution but one that doesn't work for us unfortunately.

For example, this code would be blocked by the scanner:

exec("rm -rf /path/to/delete");

But this code wouldn't be:

$process = new Process("rm -rf /path/to/delete");

Yet the effect is the same.

Is it worth adjusting the scanner to detect potential usages of this component? There may be others out there, of course, but Symfony Process is the only one that affects us at this time.