[php] Update laravel/framework 11.37.0 → 11.38.2 (minor) #174
Conversation
![depfu[bot]](https://avatars.githubusercontent.com/in/715?s=60&v=4){kind=small}
|
By default, I don't review pull requests opened by bots. If you would like me to review this pull request anyway, you can request a review via the |
|
Review changes with |
👋 Hi there!Everything looks good!
|
|
SQL Injection
DescriptionA SQL Injection is not a new or overly complicated type of attack, yet it continues to sit atop the OWASP Top Ten Application Security Risks after more than 20 years of it having been publicly utilized. This is primarily due to its inherent relative ease of use, coupled with its severity of impact when directed toward the staggeringly high number of websites with poorly written, vulnerable code. SQL is a query language that is designed to access, modify, and delete data stored in relational databases. Numerous web applications and websites use SQL databases as their method of data storage. Applications with a higher prevalence of older functional interfaces such as PHP and ASP are relatively more susceptible to SQL Injection flaws than applications based on more recent technologies. Applications are vulnerable to attacks when user-supplied data is not validated, filtered for escape characters or sanitized by the application. An attacker can use SQL Injection to manipulate an SQL query via the input data from the client to the application, thus forcing the SQL server to execute an unintended operation constructed using untrusted input. Read moreImpactA successful SQL Injection attack can result in a malicious user gaining complete access to all data in a database server with the ability to execute unauthorized SQL queries and compromise the confidentiality, integrity, and availability of the application. Depending on the backend DBMS used and the permissions granted to the user on the database, a SQL Injection could result in arbitrary file read/write and even remote code execution. The severity of attacks that have leveraged SQL Injection should not be understated. Notorious breaches, including the devastating and internationally renowned hacks of Sony Pictures and LinkedIn, for example, are reported to have been executed using SQL Injection. ScenariosSubverting application logic through SQL can lead to unpredictable outcomes depending on the context of the SQL statement and the strategy of the attacker. There are well-known exploitation techniques that attackers leverage depending on the vulnerability within the implementation of the code:
It is called blind SQL Injection when the injection succeeds, but the code doesn't return the result of the manipulated query to the attacker. Blind injections are still exploitable to retrieve the content using timing analysis, content analysis, or other out-of-bound techniques. The following is a classic example of subverting application logic to bypass access controls. Usernames and passwords are ubiquitous as the method for logging into applications. In this benign scenario, a user submits the username SELECT * FROM users WHERE username = 'user' AND password = 'secret'The login is successful if the query returns the details of the user. If the query doesn't return the user details, it is rejected. By leveraging single quotes and SQL comments ( The following example illustrates this in action. By entering SELECT * FROM users WHERE username = 'administrator'--' AND password = 'The database evaluates this statement without the commented out part, executing just the first part: SELECT * FROM users WHERE username = 'administrator'Since the manipulated query always returns the details of the PreventionTo avoid SQL Injection vulnerabilities, developers need to use parameterized queries, specifying placeholders for parameters so that they are not considered as a part of the SQL command; rather, as solely data by the database. When working with legacy systems, developers need to escape inputs before adding them to the query. Object Relational Mappers (ORMs) make this easier for the developer; however, they are not a panacea, with the underlying mitigations still entirely relevant: untrusted data needs to be validated, query concatenation should be avoided unless absolutely necessary, and minimizing unnecessary SQL account privileges is crucial. TestingVerify that where parameterized or safer mechanisms are not present, context-specific output encoding is used to protect against injection attacks, such as the use of SQL escaping to protect against SQL Injection.
|
Reviewer's Guide by SourceryThis PR updates the No diagrams generated as the changes look simple and do not need a visual representation. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Please double check the following review of the pull request:Since the provided diff is empty, there are no changes to review. However, I will still follow the guidelines to provide a structured response. Issues counts
Changes in the diffSince the diff is empty, there are no changes to summarize. Identified IssuesAs there are no changes in the diff, there are no identified issues to report. Missing TestsSince there are no changes in the diff, there are no new tests to generate. If you have any specific concerns or need further assistance, please provide more details or a non-empty diff for analysis. Summon me to re-review when updated! Yours, Gooroo.dev |
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Feedback:
This PR looks good to merge. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Here's the code health analysis summary for commits Analysis Summary
Code Coverage Report
|
github-actions
bot
added
the
size/S
gstraccini
bot
added
the
☑️ auto-merge
|
![gstraccini[bot]](https://avatars.githubusercontent.com/in/480132?s=60&v=4){kind=small}
|
@depfu merge |
Potential issues, bugs, and flaws that can introduce unwanted behavior:
Code suggestions and improvements for better exception handling, logic, standardization, and consistency:
|
|
I was unable to write a description for this pull request. This could be because I only found files I can't scan. |
|
Infisical secrets check: ✅ No secrets leaked! 💻 Scan logs2:02AM INF scanning for exposed secrets...
2:02AM INF 174 commits scanned.
2:02AM INF scan completed in 394ms
2:02AM INF no leaks found
|
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ laravel/framework (11.37.0 → 11.38.2) · Repo · Changelog
Release Notes
11.38.2
11.38.1
11.38.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 49 commits:
Update version to v11.38.2Revert "[11.x] Support DB aggregate by group (new methods) (#53679)" (#54196)Revert "Add support for missing Postgres connection options (#54101)" (#54195)Simplify codebase by using qualifyColumn helper method (#54187)Update CHANGELOGUpdate version to v11.38.1Add failing test for #54185 (#54186)Fix breaking change - Revert "[11.x] Replace string class names with ::class constants" (#54185)Update CHANGELOGUpdate version to v11.38.0Fix invokable validation rule return type (#54179)formattingMerge branch '11.x' of github.com:laravel/framework into 11.xEncode cache values for SQLite with base64 (#54178)pass options to migration events (#54151)return instead of var (#54158)Revert "Fix: Handle mixed-type values in compileInsert (#53948)" (#54169)[11.x] Make tests pass on Herd (#54171)[11.x] Make methods of `HasRelationships` generic (#54174)Update facade docblocks[11.x] Add `FormRequest::array($key)` and `Fluent::array($key)` (#54177)[11.x] Add `Dispatchable::newPendingDispatch()` (#54153)Renaming Traveler to Passable and Stops to Pipes (#54142)Correct return type to match functionality (#54148)remove unneeded interrupt clearing if there are no repeatable events[11.x] Support DB aggregate by group (new methods) (#53679)[11.x] middleware support for specific method in resource routes (#53313)[11.x] Add fluent `Email` validation rule (#54067)Add support for custom payloads and channels in broadcasting (#54099)Apply fixes from StyleCINo explicit `USE database` statement (#54132)Add action filter to route:list (#54135)[11.x] Allow exceptions to the `optimize` and `optimize:clear` commands (#54070)fix: filter vendor paths from registered loaders in Application::inferBasePath (#54119)[11.x] Refine error messages for detecting lost connections (Debian bookworm compatibility) (#54111)handles empty factory in ConnectException while recording request-response (#54121)minor readability (#54117)fix `times()` calls (#54141)refactor from string class names to constant (#54134)Fixes wrong `@mixin` (#54140)[11.x] Adds support for Attribute return mutators to the `Eloquent/Builder` pluck method (#54130)fix: Don't set newLineWritten to true unless verbosity allows output (#54127)Add support for missing Postgres connection options (#54101)Update facade docblocks[11.x] Adds `finally` method to pipeline helper (#54110)fallback to parent (#54096)Update RefreshDatabase.php (#54075)Fix offset range in docblock (#54062)Update CHANGELOGDepfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands
Summary by Sourcery
Update laravel/framework from 11.37.0 to 11.38.2.
New Features:
Bug Fixes:
Tests: