GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing github.com — Tags · cakephp/cache
Tags
5.4.4Fix PHPDoc types that do not match runtime behavior (#19674)
* Fix wrong Collection keys(), appendItem(), prependItem() and compile() types
keys() was documented as returning a collection of the values, but the
generator yields the keys. appendItem() and prependItem() kept the
original value type and dropped the type of the added item. compile(false)
claimed to keep the original keys while toArray(false) re-indexes them
with integers.
* Fix getMockForModel() and mockModel() return types
getMockForModel() returned the union Table|MockObject, so calling
expects() or method() on the result was reported as an undefined method.
The mock is always both, so the return is now an intersection, narrowed
to the table class when a class name is passed.
mockModel() declared (T|Table)&LegacyMockInterface, which collapses to
Table because T is bound to Table, so the template never reached the
caller. It now returns T&LegacyMockInterface for a class name.
* Fix EventManager::dispatch() and Hash::insert()/remove() types
dispatch('Some.event') leaked the unresolved TSubject template into
caller code. A string argument now yields EventInterface<object>.
Hash::insert() and Hash::remove() used a template that could not be
resolved for an ArrayAccess argument without generics, which reported
argument.templateType at the call site and widened the result to
array|ArrayAccess. A conditional return on the parameter covers both
cases without a template.
Both fixes make a baseline entry unmatched, so the entries are removed.
* Fix RedisEngine, ConsoleOptionParser and HelperRegistry docblocks
RedisEngine::$_Redis is natively typed Redis|RedisCluster, but its var
annotation only named Redis.
ConsoleOptionParser::_parseArg() was documented to return array<string>,
but arguments with a separator append the exploded array.
HelperRegistry::_create() had a second doc comment holding an obsolete
phpstan-ignore-next-line directly above the method. PHP only attaches the
last doc comment, so the real docblock with the param and return types
was ignored. The ignore is no longer needed.
5.3.8[Security] Add allowedClasses config to RedisEngine to prevent PHP Ob… …ject Injection (#19485) * security: add allowedClasses config to prevent PHP Object Injection in cache unserialize() RedisEngine and FileEngine both call unserialize() on data fetched from their respective backends without restricting the allowed_classes option. An attacker who can write to the cache backend (e.g., via a compromised Redis instance, APC race, or a cache-poisoning vulnerability in the application) can trigger PHP Object Injection by injecting a crafted serialized payload containing a gadget chain. Add an 'allowedClasses' configuration option (default: true = allow all, for backwards compatibility) to both engines. Applications that only cache scalar or array values can set 'allowedClasses' => false to eliminate the attack surface; applications caching known object types can enumerate only those classes. * revert FileEngine.php to master — only harden Redis/Memcache backends * Add test coverage for allowedClasses and fix failing config tests - Add the new allowedClasses key to the expected default config arrays in RedisEngineTest and RedisClusterEngineTest (the new option broke the testConfig / testConfigDsn / testConfigDsnSSLContext assertions). - Cover the allowedClasses behavior: default (true) unserializes objects, false yields incomplete class instances, an array whitelist allows only listed classes, and scalars/arrays round-trip in every mode. - Move the allowedClasses documentation into the class docblock option list to match the convention used for every other config key. --------- Co-authored-by: XananasX7 <[email protected]> Co-authored-by: Mark Scherer <[email protected]> 5.3.7[Security] Add allowedClasses config to RedisEngine to prevent PHP Ob… …ject Injection (#19485) * security: add allowedClasses config to prevent PHP Object Injection in cache unserialize() RedisEngine and FileEngine both call unserialize() on data fetched from their respective backends without restricting the allowed_classes option. An attacker who can write to the cache backend (e.g., via a compromised Redis instance, APC race, or a cache-poisoning vulnerability in the application) can trigger PHP Object Injection by injecting a crafted serialized payload containing a gadget chain. Add an 'allowedClasses' configuration option (default: true = allow all, for backwards compatibility) to both engines. Applications that only cache scalar or array values can set 'allowedClasses' => false to eliminate the attack surface; applications caching known object types can enumerate only those classes. * revert FileEngine.php to master — only harden Redis/Memcache backends * Add test coverage for allowedClasses and fix failing config tests - Add the new allowedClasses key to the expected default config arrays in RedisEngineTest and RedisClusterEngineTest (the new option broke the testConfig / testConfigDsn / testConfigDsnSSLContext assertions). - Cover the allowedClasses behavior: default (true) unserializes objects, false yields incomplete class instances, an array whitelist allows only listed classes, and scalars/arrays round-trip in every mode. - Move the allowedClasses documentation into the class docblock option list to match the convention used for every other config key. --------- Co-authored-by: XananasX7 <[email protected]> Co-authored-by: Mark Scherer <[email protected]> PreviousNext
|
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |