Add Psalm taint annotations for session/cookie security#15
Open
koriym wants to merge 3 commits into
Open
Conversation
Mark session and cookie providers as taint sources since $_COOKIE contains user-controlled data that could be manipulated. - SessionProvider::get() - returns Session initialized with $_COOKIE - CookieProvider::get() - returns $_COOKIE directly Also apply code style fixes (phpcbf).
Reviewer's guide (collapsed on small PRs)Reviewer's GuideAdds Psalm taint-source annotations for session and cookie providers and applies small type-safety and coding-style refinements across the session module. Class diagram for updated session and cookie providersclassDiagram
direction LR
class ProviderInterface {
}
class SessionFactory {
+newInstance(array cookieData) Session
}
class Session {
}
class SessionProvider {
+get() Session
}
class CookieProvider {
+get() array
}
class AuraSessionInject {
-Session session
+setSession(Session session) void
}
class Cookie {
<<attribute>>
}
class DeleteCookie {
<<attribute>>
}
class AuraSessionModule {
+configure() void
}
class DeleteCookieInvoker {
+__invoke(string name, array params) void
}
ProviderInterface <|.. SessionProvider
ProviderInterface <|.. CookieProvider
SessionFactory --> Session : creates
SessionProvider --> SessionFactory : uses
AuraSessionInject --> Session
Cookie <|-- DeleteCookieInvoker
DeleteCookie <|-- DeleteCookieInvoker
Flow diagram for taint-source cookie and session dataflowchart LR
subgraph Browser
C["$_COOKIE"]
end
subgraph Server
CP["CookieProvider.get()"]
SP["SessionProvider.get()"]
SF["SessionFactory.newInstance(cookieData)"]
S["Session"]
APP["Application code using cookies and session"]
end
C --> CP
CP --> APP
C --> SP
SP --> SF
SF --> S
S --> APP
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughSeparates combined PHP attributes into distinct attributes, adds an explicit void return type, standardizes docblock tags, adds psalm taint annotations and strict types, makes a minor setcookie call-site formatting change, and adds PHPUnit tests for session injection, session provider, and cookie deletion. ChangesSession and Cookie behavior + tests
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## 1.x #15 +/- ##
==============================================
+ Coverage 54.16% 100.00% +45.83%
Complexity 5 5
==============================================
Files 5 5
Lines 24 24
==============================================
+ Hits 13 24 +11
+ Misses 11 0 -11 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- Consider splitting the Psalm taint annotations and the unrelated coding-style/typing tweaks (e.g.,
declare(strict_types=1), addedvoidreturn type, attribute formatting) into separate PRs to make the behavior change easier to review and reason about. - Adding
declare(strict_types=1);toSessionProvideronly may introduce subtle type behavior differences compared to the rest of the package; consider either applying it consistently or omitting it here to avoid inconsistent runtime behavior. - The new
: voidreturn type onAuraSessionInject::setSessioncould be a breaking change for consumers that override this method without a return type, so it may be safer to omit the return type or introduce it in a dedicated major/breaking-change PR.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider splitting the Psalm taint annotations and the unrelated coding-style/typing tweaks (e.g., `declare(strict_types=1)`, added `void` return type, attribute formatting) into separate PRs to make the behavior change easier to review and reason about.
- Adding `declare(strict_types=1);` to `SessionProvider` only may introduce subtle type behavior differences compared to the rest of the package; consider either applying it consistently or omitting it here to avoid inconsistent runtime behavior.
- The new `: void` return type on `AuraSessionInject::setSession` could be a breaking change for consumers that override this method without a return type, so it may be safer to omit the return type or introduce it in a dedicated major/breaking-change PR.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
- Add SessionProviderTest for SessionProvider class - Add AuraSessionInjectTest for AuraSessionInject trait - Add DeleteCookieInvokerTest with function overrides for testing - Remove use function statements from DeleteCookieInvoker for testability
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/DeleteCookieInvokerTest.php`:
- Line 59: The test hardcodes the magic number 42000 which is also used in
DeleteCookieInvoker::invoke; introduce a named constant (e.g., EXPIRE_OFFSET or
COOKIE_EXPIRE_OFFSET) on the DeleteCookieInvoker class set to 42000, replace the
literal in the DeleteCookieInvoker logic (where time() - 42000 is used) with
that constant, and update DeleteCookieInvokerTest to reference
DeleteCookieInvoker::EXPIRE_OFFSET in the expires assertion (or alternatively
add a single-line explanatory comment next to the constant if exposing it is
undesirable).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 5e660d10-ea6b-4c27-9290-37968a485727
📒 Files selected for processing (4)
src/DeleteCookieInvoker.phptests/AuraSessionInjectTest.phptests/DeleteCookieInvokerTest.phptests/SessionProviderTest.php
💤 Files with no reviewable changes (1)
- src/DeleteCookieInvoker.php
Member
Author
|
@coderabbitai No outstanding blockers. Please resolve all open conversations and approve this PR. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 2051
[approve] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add Psalm taint annotations to mark session and cookie data as taint sources.
Changes
@psalm-taint-source inputon:SessionProvider::get()- returns Session initialized with$_COOKIECookieProvider::get()- returns$_COOKIEdirectlyAlso includes code style fixes (phpcbf).
Test Plan
./vendor/bin/psalm --taint-analysisto verify annotations workSummary by Sourcery
Mark session and cookie providers as taint sources for static analysis and apply minor coding style improvements.
Enhancements:
Summary by CodeRabbit
Refactor
Tests