Php-framework-PHPcomposer

There are two questions: 1. What should I do if the code in the original address has a vulnerability or a backdoor? 2. If there is any modification after the download, will the update be overwritten? Two questions:
1. What should I do if the code in the original address has a vulnerability or a backdoor?
2. If there is any modification after the download, will the update be overwritten?

Reply content:

Two questions:
1. What should I do if the code in the original address has a vulnerability or a backdoor?
2. If there is any modification after the download, will the update be overwritten?

To use a third party, you must be prepared to bear the risk that a third party has vulnerabilities. As for backdoors, since the code is in your hands, it is your responsibility to troubleshoot backdoors. If you use a third-party component, you should use the object-oriented method to modify it instead of directly modifying the source code.

1. You can fork a copy of the source code, modify the vulnerabilities or backdoors you think, then go to packagist.org to release your releases, and replace the original address in the project.

2. You are not advised to directly modify the code in./vendor. The Code will be overwritten during the update.

1-usually no. If you find it, the processing method is the same as 2.
2-Don't put it in the vendor, just use it as your own stuff, HOHO