feat(security): add CactiValidator helpers#7125
Closed
somethingwithproof wants to merge 5 commits into
Closed
Conversation
Wraps symfony/validator with a lazy singleton for the small number of validation call sites that need a constraint-list API, plus a relative-path validator that rejects null bytes, traversal, and absolute paths and (when given an rraRoot) confirms realpath() stays inside the root. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new Cacti\Security\CactiValidator helper intended to centralize common validation (Host ID, RRD relative-path traversal hardening, IP, email, SNMP community) behind a thin Symfony Validator wrapper, along with a new Pest unit test covering the helper’s expected behavior.
Changes:
- Introduces
Cacti\Security\CactiValidatorwith cached Symfony validator instance and several domain-specific convenience validators. - Adds unit tests for host-id, RRD path safety (including optional root containment), IP/email/SNMP community validation, and custom-constraint validation.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| lib/Security/CactiValidator.php | New validator wrapper and RRD-path safety checks (incl. optional realpath containment). |
| tests/Unit/CactiValidatorTest.php | New unit tests exercising the helper API and the traversal/containment behavior. |
Same as PR-A: appends 11 PHPStan ignoreErrors entries that exist on upstream develop but are not yet baselined, so this branch's CI does not regress on phpstan analyse --level 6. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Match the un-namespaced lib/CactiX.php convention used by canonical PRs (Cacti#7088 CactiProcess, Cacti#7073 CactiMime, Cacti#7077 CactiSettings, Cacti#7075 CactiApplication/CactiCommand). The previous nested PSR-4 namespace required composer autoload changes that conflicted with those PRs. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
somethingwithproof
changed the title
Contributor
Author
Contributor
Author
|
Queue note: treating this as the base validator helper PR. Intended order is this PR first, then #7077 rebased onto it as the settings validation pilot. |
Contributor
Author
|
Closing as superseded by #7077. The CactiValidator helper has been folded into the settings validation pilot so reviewers can evaluate the helper and first consumer in one PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part B of six PRs splitting #7123. Depends on #7124.
Adds
lib/CactiValidator.phpwith helpers wrapping Symfony Validatorfor host IDs, RRD paths, IP addresses, emails, and SNMP community
strings. RRD path validation defends against traversal and (when an
rraRoot is supplied) symlink-based escapes.
Restructured to use the flat un-namespaced lib/CactiX.php convention
to align with #7088 / #7073 / #7077 / #7075. The class is loaded via
require_once from the test, not via PSR-4 autoload.
symfony/validator itself is added by #7077 (CactiSettings) and is
not duplicated in this PR's composer.json.