codeigniter4 / CodeIgniter4

88%

develop: 88%

LAST BUILD ON BRANCH fix/csrf-array-token-injection

branch: fix/csrf-array-token-injection

CHANGE BRANCH

x

Reset

• fix/csrf-array-token-injection
• 250708_error_time
• 4.0.0
• 4.0.2
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.7-addCalendarMonth
• 4.7-test
• 4.8
• 4.develop
• Clean-up-transactions
• FeatureTestCaseBodyFix
• Remove-old-PHP-5-code
• always-true
• apcucache
• api-pagination
• api-resources
• apiformat
• app/Config/Cache.php-formatting
• appstarterfix
• array-options
• arrayiterator-deprecated
• attached-options
• autoroute-attributes
• baseline-errors
• branch-alias-all
• bug-entity
• bump-mssql-image
• bump-phpstan-221
• cache-redis-persistent
• call-silent
• carbonads
• cellcachename
• check-phpini
• chore-add-structarmed
• chore-bump-phpstan-2136
• chore-bump-phpstan-fix-notice
• chore-bump-phpstan205
• chore-bump-rector-206
• chore-bump-rector-215
• chore-bump-rector-216
• chore-bump-rector-221
• chore-bump-rector-252
• chore-bump-structarmed
• chore-bump-structarmed-011-use-layer-expands
• chore-fix-phpstan-notice
• chore-pin-phpstan-2134
• chore-prepare-for-rector-230
• chore-remove-require-php-version-in-test
• chore-use-single-class-per-file
• chore-use-with-roots
• chore/bump-escaper
• chore/feature-test
• chore/fix-phpstan-d-function
• chore/imagick
• chore/phpunit-config
• chore/rector-232
• chore/remove-incomingrequest-deprecations
• chore/update-kint-601
• ci-rule-customisation
• citeststreamfilter
• cleanup-autoloader
• cleanup-cache-filehandler
• cleanup-ci
• cleanup-db
• cleanup-exceptions
• cleanup-filter-collector
• cleanup-filters
• cleanup-http
• cleanup-implicit-nullable-3rd-p
• cleanup-security
• cleanup-services
• clear-logs-ux
• clearcache
• cli-double-hyphen
• cli-option-defaults
• cli-remove-deprecations
• cliprint
• command-name-aliases
• command-phpini
• commandrefactor
• complete-query-interface
• console-last-exec-command
• cookie-constructor-options
• cookie-date-format
• cookie-phpdocs
• create-database-migration
• create-model-tests
• csp
• csp-hash
• csp-nonces
• csp-refactor
• csp-report-to
• csp3-keyword-sources
• curldebugfix
• db-exception-interface
• dbcompiled
• dbtables
• debugbar-ajax-like-requests
• defaultfixes
• deletedat
• dependabot/composer/composer-dependencies-01edd1efc8
• dependabot/composer/composer-dependencies-0540b2ec28
• dependabot/composer/composer-dependencies-0c09d62212
• dependabot/composer/composer-dependencies-1844d23082
• dependabot/composer/composer-dependencies-2604699776
• dependabot/composer/composer-dependencies-2aeeaf3fff
• dependabot/composer/composer-dependencies-2c8c5a494c
• dependabot/composer/composer-dependencies-3e6e6e4cb1
• dependabot/composer/composer-dependencies-50bb723f14
• dependabot/composer/composer-dependencies-53975127aa
• dependabot/composer/composer-dependencies-85347f50db
• dependabot/composer/composer-dependencies-855c58c274
• dependabot/composer/composer-dependencies-91a4d521d7
• dependabot/composer/composer-dependencies-9e75bae6e5
• dependabot/composer/composer-dependencies-a438584d12
• dependabot/composer/composer-dependencies-a956dfbda2
• dependabot/composer/composer-dependencies-be72c61d91
• dependabot/composer/composer-dependencies-c2f267580f
• dependabot/composer/composer-dependencies-cdab9451e1
• dependabot/composer/composer-dependencies-dee3913898
• dependabot/composer/composer-dependencies-e7eda41fb4
• dependabot/composer/composer-dependencies-eec4030506
• dependabot/composer/composer-dependencies-f416528f79
• dependabot/composer/composer-dependencies-f7f8ef0ac9
• dependabot/composer/phpstan/phpstan-2.1.36
• dependabot/composer/predis/predis-tw-3.0.0
• dependabot/composer/rector/rector-2.0.10
• dependabot/composer/rector/rector-2.0.12
• dependabot/composer/rector/rector-2.0.14
• dependabot/composer/rector/rector-2.0.15
• dependabot/composer/rector/rector-2.0.16
• dependabot/composer/rector/rector-2.0.17
• dependabot/composer/rector/rector-2.0.18
• dependabot/composer/rector/rector-2.0.8
• dependabot/composer/rector/rector-2.0.9
• dependabot/composer/rector/rector-2.1.0
• dependabot/composer/rector/rector-2.1.1
• dependabot/composer/rector/rector-2.1.3
• dependabot/composer/rector/rector-2.1.4
• dependabot/composer/rector/rector-2.1.5
• dependabot/composer/rector/rector-2.1.7
• dependabot/composer/rector/rector-2.2.0
• dependabot/composer/rector/rector-2.2.10
• dependabot/composer/rector/rector-2.2.11
• dependabot/composer/rector/rector-2.2.14
• dependabot/composer/rector/rector-2.2.2
• dependabot/composer/rector/rector-2.2.3
• dependabot/composer/rector/rector-2.2.4
• dependabot/composer/rector/rector-2.2.5
• dependabot/composer/rector/rector-2.2.6
• dependabot/composer/rector/rector-2.2.7
• dependabot/composer/rector/rector-2.2.8
• dependabot/composer/rector/rector-2.2.9
• dependabot/composer/rector/rector-2.3.1
• dependabot/composer/rector/rector-2.3.5
• dependabot/composer/rector/rector-2.3.6
• dependabot/composer/rector/rector-2.3.7
• dependabot/composer/rector/rector-2.3.8
• dependabot/composer/rector/rector-prefixed-0.8.13
• dependabot/github_actions/actions/cache-5
• dependabot/github_actions/actions/checkout-5
• dependabot/github_actions/actions/checkout-6
• dependabot/github_actions/actions/upload-artifact-5
• dependabot/github_actions/actions/upload-artifact-6
• dependabot/github_actions/actions/upload-artifact-7
• dependabot/github_actions/ad-m/github-push-action-v0.6.0
• dependabot/github_actions/ammaraskar/sphinx-action-0.4
• dependabot/github_actions/github_actions-003dc165f5
• dependabot/github_actions/github_actions-20de5e3257
• dependabot/github_actions/github_actions-2217aebe03
• dependabot/github_actions/github_actions-4684ddd577
• dependabot/github_actions/github_actions-5dacb66663
• dependabot/github_actions/github_actions-636cd4b091
• dependabot/github_actions/github_actions-6a98abd9ac
• dependabot/github_actions/github_actions-79fecd259f
• dependabot/github_actions/github_actions-823d5f4d9a
• depr-csp-nonce-prop
• deprecate-filehandler-cache-redundant-methods
• deprecated-clean-path
• deprecated-filter-default
• deprecated-null-array-offset
• deprecated-strtoupper-method
• deterministic-cached-router-test
• dev-ci-version
• dev-master-composer
• develop
• discovercomposer
• display-all-issues
• dns-cache-time-curl
• docautobuild
• docs-api-fail-validation
• docs-changelog-4.7.2
• docs-changelog-4.7.3
• docs-changelog-4.7.4
• docs/entity-desc
• docs/throttler-check-internal
• dupheaders
• duplicate-property-dec
• empty-property
• entityrefactor
• env-fix-arg
• env-phpdocs
• environment-detector
• escape-host
• escapeinserts
• escaper
• escaper-2.17
• eventcallables
• events-refactor
• feat-avif-support
• feat-dot-array-object-followup
• feat-lang-sync
• feat/api-transformer-relations
• feat/api-transformer-sparse-fieldsets
• feat/array-helper-extended
• feat/assert-sql-equals
• feat/batchMethods
• feat/cache-locks
• feat/cache-remember-interface
• feat/cache-status-codes
• feat/chunk-array
• feat/clamp-method
• feat/context
• feat/copy-error-report
• feat/curlrequest-retry
• feat/database-in-transaction
• feat/db-timezone
• feat/db-transaction-callbacks
• feat/db-transaction-closure
• feat/dot-array-objects
• feat/encryption-previousKeys
• feat/entity-to-raw-array
• feat/entity-track-changes-deeply
• feat/enum-cast
• feat/env-dir
• feat/exists-query-builder
• feat/fetch-metadata-csrf
• feat/first-or-insert
• feat/float-cast-precision
• feat/form-request
• feat/formrequest-continue-validation-failure
• feat/formrequest-prepared-validation-data
• feat/formrequest-typed-accessors
• feat/from-query-from-header-attributes
• feat/granular-nonces
• feat/having-between-query-builder
• feat/image-clearMetadata
• feat/imagick-rewrite
• feat/improve-registrars
• feat/increment-multiple
• feat/is-available-method
• feat/join-condition-ergonomics
• feat/lazy-cache-ttl
• feat/logger-with-context
• feat/logging-context
• feat/match-regex-placeholder
• feat/md-mime
• feat/memcached-lock-store
• feat/migration-lock
• feat/model-exists-by-id
• feat/namespaced-view-overrides
• feat/prepared-query-exception-classification
• feat/previous-enc-keys
• feat/previousKeys
• feat/primaryKeyValidation
• feat/query-builder-backed-enums
• feat/query-builder-date-helpers
• feat/query-builder-explain
• feat/query-builder-insert-get-id
• feat/query-builder-like-any
• feat/query-builder-lock-for-update
• feat/query-builder-shared-lock
• feat/query-builder-value-pluck
• feat/query-builder-where-between
• feat/query-builder-where-column
• feat/registrars-merge-directives
• feat/request-id
• feat/retryable-transaction-exceptions
• feat/scoped-transaction-options
• feat/signals
• feat/source-explicit-request-input
• feat/sse-response
• feat/strict-field-protection
• feat/strict-locale-negotiate
• feat/superglobals
• feat/time-between-min-max
• feat/transaction-retry-attempts
• feat/unique-exception
• feat/uri-query-immutable-helpers
• feat/uri-query-param-mutation
• feat/user-agents-robots
• feat/validation-errors
• feat/where-exists-query-builder
• feature-add-page-start-end-total-to-page-renderer
• feature/email
• feature/email/SMTP-PLAIN-auth-method
• feature/number_helper
• feature/parser
• feature/queue
• feature/resource
• feature/superglobals
• featuretestredirectsareok
• filemove
• filtermatchfix
• fix-array-group-by-objects
• fix-arraycast-unserialize
• fix-command-output-buffer
• fix-cookie-samesite-empty-defaults
• fix-cs
• fix-cs-and-psalm
• fix-csrf-token
• fix-db-tests
• fix-debug-toolbar-logs
• fix-delete-db-after-tests
• fix-escaper
• fix-featuretesttrait-withroutes
• fix-imagemagic-rate-limit
• fix-inconsistent-cli-write
• fix-linux-hang-on-sudo
• fix-mark-as-tempdata
• fix-namespaced-helper
• fix-nonboolean-expr
• fix-phpdoc-console
• fix-phpdoc-parse-error
• fix-phpstan
• fix-phpstan-callable-types
• fix-phpstan-only-boolean-allowed
• fix-redis-handler-lock-retries
• fix-redis-tests-sanity
• fix-reproportion-division-by-zero
• fix-security
• fix-security-hex2bin-valueerror
• fix-session-ci-vars-protection
• fix-stty-error
• fix-syscall-issue-commands-test
• fix-toolbar
• fix-tput
• fix-unknown-supportpath-const
• fix/PHPSTAN-no-type-specified
• fix/PHPSTAN-no-type-specified-ModelTest
• fix/PHPSTAN-no-type-specified-SaveModelTest
• fix/PHPSTAN-no-type-specified-UpdateModelTest
• fix/add-lang-keys
• fix/affectedRows
• fix/attribute-filters
• fix/autoload-unregister
• fix/autoreview
• fix/base64-validation
• fix/baseresult
• fix/cache-get
• fix/cache-interface
• fix/cache-interface-2
• fix/cell-type-error
• fix/check-writepath
• fix/common-env-typeerror-esc-leak
• fix/connection-getFieldData
• fix/connection-share
• fix/content-disposition
• fix/controller-attributes
• fix/cors
• fix/cs-fixer
• fix/csp-json-escape
• fix/csp-src-elem
• fix/csrf-with-header
• fix/curl-request-response
• fix/curl_multiple_header_sections_after_redirects
• fix/custom-uri-schema
• fix/database-properties-casting
• fix/datacaster-error
• fix/db-session
• fix/debugbar-history
• fix/deleteMatching
• fix/dot-array-filter
• fix/email-cid
• fix/email-destruct
• fix/encryption-inconsistency
• fix/entity-loses-attr
• fix/entity-mapped-primaryKey
• fix/entity-tests
• fix/escape-identifiers-bypass
• fix/exception-format
• fix/filehandler-gc-toctou
• fix/formrequest-json-failure-detection
• fix/frankenphp-zlib-output-compression
• fix/func-to-multibyte
• fix/function-call
• fix/get-hostname
• fix/hardcoded-csp-tags
• fix/headers
• fix/incomingrequest-issecure
• fix/invalid-chars-array-map
• fix/issue-8732-basemodel-types
• fix/lang-typo
• fix/logger
• fix/logger-collector
• fix/model-chunk
• fix/model-recursive
• fix/modelReplace
• fix/modifyColumn-postgre
• fix/multibyte-characters-in-folder-name
• fix/nested-folder-rewrite-with-index
• fix/non-html-exceptions
• fix/oci8-getVersion
• fix/oci8-refactor-limit
• fix/orderBy
• fix/pagination
• fix/phpstan
• fix/phpstan-rector
• fix/phpstan-rule-filters
• fix/pk-model-checker
• fix/postgre-increment-decrement-bug
• fix/prepareStatementBinary
• fix/prepared-query-prepare
• fix/prepared-query-transactions
• fix/random-order-commands-tests
• fix/random-tests
• fix/rector
• fix/reflection
• fix/remove-check-json
• fix/rename-phpunit-file
• fix/required-without-logic
• fix/rules-required-without
• fix/safari-user-agent-version
• fix/seeder
• fix/session-memcached
• fix/session-migrations
• fix/signals-windows
• fix/sodium-handler-encrypt-decrypt-bugs
• fix/sqlite-connect
• fix/sqlsrv-decrement-bug
• fix/test-transformers
• fix/tests-migration-lock
• fix/time
• fix/time-tests-for-arab
• fix/toolbar
• fix/transformer-nested-state-leakage
• fix/typo-exception
• fix/updateBatch
• fix/upsert-composite-index
• fix/validation-headers
• fix/validation-key-not-exists
• fix/view-fallback
• fix/when-condition
• fix/worker-kint-csp-nonces
• fix/worker-mode-events
• forge-drop-column
• forge-fields
• fresh-connect-curl
• full-test-cache-clear
• full-test-debugbar-clear
• full-test-logs-clear
• function-already-narrowed
• generator-value-type
• implicit-array-creation
• import-symbols
• improve-for-windows
• isset-magic-property
• isset-property
• jim-parry-testing30
• json-depth-option
• key-generate-export
• key-generate-ux
• key-rotate
• kint3
• kintphp-bump-version
• kintphp-version-bump
• laminas-escaper
• laminas-escaper-2.16
• lang-find-resolved-keys
• lang-modern-commands
• lang-nested-arrays
• layouts
• lazy-load-csp-and-cookie
• localematching
• logs-clear-ux
• make-test
• make-test-empty-class
• make-test-suffix
• master
• mavelo-llc-patch-1
• merge-4.6
• message-return
• method-namecase
• method-void
• migrate-cache-info
• migrate-deptrac-to-structarmed
• migrate-key-generate
• migrate-migration
• migrate-seed
• migrate-show-table-info
• migration-union
• migrations
• migrationsutc
• minimal-php82
• missing-return-system
• missing-type-return
• mock-io-filter-restore
• model-argument-type
• modelgetfix
• modelhelper
• modelvalidate
• modelvalidationfix
• modernize-stripos
• more-csp3-directives
• more-trailing-commas
• move-deprecation-early
• native-phpdocs
• new-static
• non-bools-in-ifs
• non-interactive-mode
• noprimarykey
• null-coalesce-variable
• optimize-autoreview
• optimize-download-response
• optimize/superglobals-injection
• pagerurifix
• parserpluginfix
• partial-email-refactor
• patch-1
• patch-2
• patch-3
• patch-4
• perf-optimize-imagick-installation
• perf/optimize-autoloader
• perf/optimize-basebuilder
• perf/optimize-limitZeroAsAll
• php-ini-values
• php74
• phpdoc-variable-naming
• phpstan-codeigniter
• phpstan-codeigniter-v2
• phpstan-tests
• phpstan-windows-support
• phpunit-php85
• postgresEscapeFlags
• prepend-autoloader
• previousurlfix
• property-protected
• property-unused-type
• psalm-6.12
• publisher-rate-limit
• queryfix
• readonly-prop
• rector-update
• redirect-exception
• redirectWiths
• redirectresponseurl
• refacto/phpstan-config-instance-of
• refactor-add-arrow-function-return
• refactor-add-var-config-doc-tests
• refactor-api-response-trait
• refactor-apply-code-quality-40
• refactor-apply-code-quality-41
• refactor-apply-code-quality-51
• refactor-apply-code-quality-52
• refactor-apply-code-quality-54
• refactor-apply-code-quality-58
• refactor-apply-code-quality-61
• refactor-apply-code-quality-level-27
• refactor-array-doc-based-on-array
• refactor-assert-not
• refactor-cache
• refactor-codeigniter
• refactor-command-tests
• refactor-console
• refactor-constructor-promo
• refactor-cookie-date
• refactor-email-cleanup
• refactor-enable-code-quality-level-34-for-rector
• refactor-enable-fn-to-first
• refactor-enable-instance-strict
• refactor-enable-remove-null-arg
• refactor-filelocator-listfiles
• refactor-format
• refactor-language
• refactor-logger
• refactor-mock-classes
• refactor-more-strict
• refactor-phpunit-config
• refactor-run-rector-latest-dev
• refactor-session
• refactor-style
• refactor-upgrade-phpstan-2-rector-2
• refactor-uri
• refactor/api-tests
• refactor/between-array-type
• refactor/cli-tests
• refactor/cli-tests-again
• refactor/debugbar
• refactor/deprecated-filecache-property
• refactor/deprecated-void
• refactor/entity-rework
• refactor/feature/email-SMTH-AUTH-METHOD
• refactor/filters-parent-phpdoc
• refactor/form-request
• refactor/image
• refactor/join-condition-compiler
• refactor/kint-worker-mode
• refactor/list-tables-cached-list-shape
• refactor/model-types
• refactor/phpdoc-improve
• refactor/phpstan-callable-types
• refactor/phpstan-child-return-fluent-docs
• refactor/phpstan-class-notFound
• refactor/phpstan-cond-not-bool
• refactor/phpstan-expr-result-unused
• refactor/phpstan-framework-exception-instance
• refactor/phpstan-func-inner
• refactor/phpstan-func-not-found
• refactor/phpstan-generator-return-type
• refactor/phpstan-greater-or-equal
• refactor/phpstan-isset-offset
• refactor/phpstan-method-impossibleType
• refactor/phpstan-method-unused
• refactor/phpstan-model-argument-instanceof
• refactor/phpstan-nullCoalesce
• refactor/phpstan-offsetAccess-notFound
• refactor/phpstan-parameterByRef-unusedType
• refactor/phpstan-return-missing
• refactor/phpstan-return-type
• refactor/phpstan-right-true
• refactor/phpstan-types
• refactor/phpstan-unset-offset
• refactor/phpstan-varTag.type
• refactor/query-builder-condition-compiler
• refactor/random-string-types
• refactor/random-tests-commands
• refactor/random-tests-small-components
• refactor/rm-deprecated-deps-cookie
• refactor/rm-deprecated-event-const
• refactor/rm-deprecated-formatter
• refactor/rm-deprecated-redirect-exception
• refactor/rm-view-deprecated
• refactor/session
• refactor/setcurloptions
• refactor/sqlite-registrar
• refactor/toolbar-test
• refactor/typing-commands
• refactor/use-assert-same-sql
• refactor/user-agent
• refactor/valideatedInput
• reflection-setAccessible
• refreshed-commands
• regroup-command-tests
• release-4.5.6
• release-4.5.7
• release-4.5.8
• release-4.6.0
• release-4.6.1
• release-4.6.2
• release-4.6.3
• release-4.6.4
• release-4.6.5
• release-4.7.0
• release-4.7.1
• release-4.7.2
• release-4.7.3
• remove-base-branch-checkout
• remove-bootstrap
• remove-cache-basehandler
• remove-curl-close
• remove-dead-catch
• remove-imagedestroy
• remove-unremoved-test
• rename-controller-to-Controller
• rename-further-h-option
• rename-routes-option
• rename-stdclass-to-stdClass
• render-backtrace
• response-remove-app
• responsecachestatus
• return-unused-type
• revert-1730-routefix
• revert-cpp-exceptions
• review-php85
• routefix
• routemethod
• routesdualloadfix
• routing-options
• sample-uri-generator
• samsonasik-patch-1
• searchorder
• security-hardening
• sensitive-parameter
• session-redis-persistent
• sessionarrayhandler
• sessionhandlers
• sessions
• set-locale-broad
• share-connection-curl
• show-header
• softdelete
• split-phpstan-baseline
• sqlitedropfk
• sqlitedropindex
• static-getPrivateMethodInvoker
• strict-on-true
• strict-types-tests
• stringrule
• subdomain-detection
• subnamespace
• superglobals-refactor
• test-deprecated
• test-insert-strict-mode
• test-separate-process
• test/time-dependence
• testing-session-mark-as
• tests-all-with-return-types
• time-ispast-isfuture
• time-refactor
• typos
• unicodeEntityJson
• unknown-service-method-name
• unuse-returntypewillchange
• update-baseline
• update-gvenzl
• update-mysql-80
• update-rector
• update-to-predis-3
• update-util-bootstrap
• update-workflows
• url-is
• urlfixes
• urlzerofix
• use-x-dev
• useless-dotenv-test
• util-bootstrap
• ux-modern-commands
• v4.0.0-alpha.3
• v4.0.0-alpha.4
• v4.0.0-alpha.5
• v4.0.0-beta.1
• v4.0.0-beta.3
• v4.0.0-beta.4
• v4.0.0-rc.1
• v4.0.0-rc.2
• v4.0.0-rc.2.1
• v4.0.0-rc.2b
• v4.0.0-rc.3
• v4.0.0-rc.4
• v4.0.0.0-alpha.5
• v4.0.1
• v4.0.3
• v4.0.4
• validinserts
• variable-undefined-et-al
• worker-mode
• worker-modern-commands

Build # 27721567626

Build Type

Pull #10322

github

Committed by web-flow

Commit Message

Merge 8e1fee994 into b08160c4c

Pull Request Pull Request #10322: fix: guard against parse_str array injection in CSRF token handling

Coverage Stats

27 of 27 new or added lines in 1 file covered. (100.0%)

22187 of 25129 relevant lines covered (88.29%)

211.7 hits per line