Can Blackjack be made optional?

[SPMatthewMcD]

Deployer Version

7.5.12

Target OS

Ubuntu 22.04

Which PHP version are you using?

PHP 8.3

Content of deploy.php or deploy.yaml

(md5(strval(getenv('MONEY')))

Steps to reproduce

I tried to open this as an issue, but I am getting a "No templates available for the current repository" error.
I am wondering if the Blackjack component of Deployer can be made "optional". The reason I ask is the code scanner Snyk is flagging the md5 (and sha1 hash in MainCommand) as a low severity vulnerability (CWE-916).

I am a novice with PHP but would be happy try and resolve these as they are peripheral to deployer functionality.

If this is not appropriate here let me know.

[antonmedv]

Yes) I can make it even better and drop md5 completely.

[antonmedv]

Thanks. It will help.

[SPMatthewMcD]

I think there is a community edition of Snyk that can be run against open source repos to get this same info. I also realize that for compatibility the recipes may need the MD5 hash. But here is the gist of what I am seeing
CWE-78 | Command Injection | DumpCompletionCommand.php | line 125 unsanitized input from $debugfile
CWE-23 | Path Traversal | PharUpdate/Manifest.php | line 112
CWE-916 | MD5 Hash | Messenger.php | line 57, line 84
CWE-916 | MD5 Hash | ispmanager.php | line 769
CWE-916 | SHA1 Hash | MainCommand.php | line 98
CWE-916 | SHA1 Hash | PharUpdate/Update.php | line 200

[SPMatthewMcD]

Again, I am a novice to this, is it possible that an upgrade to the latest symfony would resolve the DumpCompletionCommand.php issue?

[antonmedv]

No. All of those "issues" are false positives. Not real security problems. But for some of them we can do something.

[SPMatthewMcD]

I figured. I love deployer. Thank you!