hardening: migrate uninstall drop statements to prepared - #25
hardening: migrate uninstall drop statements to prepared#25somethingwithproof wants to merge 6 commits into
Conversation
somethingwithproof
changed the title
There was a problem hiding this comment.
Pull request overview
This PR updates the plugin uninstall routine to use prepared-statement execution for table drops and adds a lightweight regression test to ensure raw db_execute() DROP TABLE statements don’t return.
Changes:
- Switched DROP TABLE calls in
plugin_evidence_uninstall()fromdb_execute()todb_execute_prepared(). - Added a PHP test script that inspects
setup.phpto enforce the prepared-statement usage.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
setup.php |
Replaces raw DROP TABLE executions with db_execute_prepared() in the uninstall routine. |
tests/test_prepared_statements.php |
Adds a simple string-based regression test to validate uninstall DROP statements use db_execute_prepared(). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
|
Incorporated follow-up feedback in |
Add targeted tests for prepared statement migration, output escaping, auth guard presence, CSRF token validation, redirect safety, and PHP 7.4 compatibility. Tests use source-scan patterns that verify security invariants without requiring the Cacti database. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
|
Converted to draft to serialize the stack in this repo. Blocked by #23; will un-draft after that merges to avoid cross-PR merge conflicts. |
Summary
Implements issue #24 by migrating plugin uninstall drop-table statements to prepared DB helpers.
Changes
plugin_evidence_uninstall()insetup.php:db_execute("DROP TABLE ...")calls todb_execute_prepared('DROP TABLE ...')tests/test_prepared_statements.phpValidation
php -l setup.phpphp -l tests/test_prepared_statements.phpphp tests/test_prepared_statements.phpIssue
Closes #24