Repository navigation
Release 3.0.52 - #95
Merged
Merged
Conversation
Bumps the version and records what landed after 3.0.51. The beacon can now be told which surface the process is serving (#93). Until this, the only thing distinguishing a cron from a shopper's page render was PHP_SAPI, and that answers a different question: Magento's cron entry point refuses to run under the CLI SAPI, so an installation running cron over HTTP has been reporting as web. The action is attacker-controlled, so the rule that bounds it is the substance of the change rather than a detail of it -- rejected whole rather than repaired, ASCII-only so a malformed byte cannot cost the whole report, anchored at \z because PHP's $ also matches before a final newline, and refusing a token made only of separators. And the docblocks that explained those rules by describing the far end now explain them on this library's own terms (#94), which is where they stood all along. Comment only. Nothing here changes what any existing caller does. A host that never calls setSurface() produces the envelope it produced before, key for key.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Version bump and changelog. No code changes.
What it releases
#93 — the caller's surface. The beacon can be told the application area and the action a process dispatched. Until now the only thing separating a cron from a shopper's page render was
PHP_SAPI, which answers a different question: Magento's cron entry point refuses to run under the CLI SAPI, so an installation running cron over HTTP has been reporting as web all along.Instance state, beside the user agent rather than on a bucket, because a bucket exists only once an API key has been seen and the dispatch happens whether or not one ever is.
The action can be attacker-controlled, so the rule that bounds it is the substance rather than a detail: rejected whole rather than repaired, ASCII-only so a malformed byte cannot cost the whole report, anchored at
\zbecause PHP's$also matches immediately before a final newline, and refusing a token made only of separators — which is what an unrouted request composes.#94 — docblocks on this library's own terms. Comment only. Rules that were explained by describing how the far end is built are now explained by what they do here, which is where every one of them actually stands.
Inert until a host calls it
setSurface()does nothing on its own. A host that never calls it produces the envelope it produced before, key for key — verified on a running install. The extension side is merged and ships in the next module release, which raises its floor to this version.Gates green:
tools/tests/test-surface-token.php31 checks,tools/no-deprecated-calls.php64 files 0 findings.