appsec/laravel: be more defensive#3503
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #3503 +/- ##
==========================================
- Coverage 61.74% 61.60% -0.14%
==========================================
Files 142 142
Lines 12975 12975
Branches 1700 1700
==========================================
- Hits 8011 7993 -18
- Misses 4204 4222 +18
Partials 760 760 see 4 files with indirect coverage changes Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
Benchmarks [ appsec ]Benchmark execution time: 2025-11-26 18:43:47 Comparing candidate commit 05af36e in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics. |
Benchmarks [ tracer ]Benchmark execution time: 2025-12-04 11:29:04 Comparing candidate commit e985cb6 in PR branch Found 3 performance improvements and 6 performance regressions! Performance is the same for 185 metrics, 0 unstable metrics. scenario:ComposerTelemetryBench/benchTelemetryParsing
scenario:MessagePackSerializationBench/benchMessagePackSerialization
scenario:MessagePackSerializationBench/benchMessagePackSerialization-opcache
scenario:SamplingRuleMatchingBench/benchRegexMatching1
scenario:SamplingRuleMatchingBench/benchRegexMatching2
scenario:SamplingRuleMatchingBench/benchRegexMatching3
scenario:SamplingRuleMatchingBench/benchRegexMatching4
scenario:SpanBench/benchOpenTelemetryAPI
scenario:TraceSerializationBench/benchSerializeTrace
|
cataphract
force-pushed
the
glopes/appsec-laravel-fix
branch
from
05af36e to
b49e000
Compare
Just doing isset($user['username']) is not safe is $user doesn't
implement ArrayAccess.
php > class A {}
php > $a = new A;
php > var_dump(isset($a['x']));
PHP Warning: Uncaught Error: Cannot use object of type A as array in php shell code:1
Stack trace:
thrown in php shell code on line 1
cataphract
force-pushed
the
glopes/appsec-laravel-fix
branch
from
b49e000 to
e985cb6
Compare
3 participants
Just doing isset($user['username']) is not safe is $user doesn't implement ArrayAccess.
php > class A {}
php > $a = new A;
php > var_dump(isset($a['x']));
PHP Warning: Uncaught Error: Cannot use object of type A as array in php shell code:1 Stack trace:
thrown in php shell code on line 1
Description
Reviewer checklist