CallableChecker accepts any truthy result of its callable since 4.1.8

未关闭
  • 哪里不对？
#767 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
76/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
php
领域
backend-api-design

调研方向

Start with CallableChecker::checkClaim() and checkHeader(), then inspect CallableCheckerTest::theCallableDoesNotReturnABoolean() and .ci-tools/rector.php. Add separate claim and header cases for the listed non-boolean results, and confirm both methods refuse every result other than true while the Rector job preserves that behavior. Update the changelog to explain the return-value requirement.

由索引模型根据 Issue 内容生成。

描述

bug
Version(s) affected

4.1.8 to 4.1.10, 4.2.0 to 4.2.5, and the 4.3.x and 5.0.x branches. 3.4.x and 4.0.x are not affected.

Description

From 3.3.0 to 4.1.7, Jose\Component\Checker\CallableChecker accepted a claim or header value only when its callable returned true; any other result was a refusal. Since 4.1.8, any truthy result accepts the value: 1, a non-empty string, a non-empty array, an object.

The strict comparison was lost in a Rector rewrite (SimplifyBoolIdenticalTrueRector) in 6c2bdcff, in both checkClaim() and checkHeader():

-        if (call_user_func($this->callable, $value) !== true) {
+        if (! call_user_func($this->callable, $value)) {

Rector trusts the docblock callable(mixed $value): bool, which nothing enforces at run time. Callables that return a boolean behave as before. A callable that reports a refusal with a truthy value (an error message, a list of errors, an object, a non-zero code) now accepts the value it means to refuse.

CallableCheckerTest::theCallableDoesNotReturnABoolean() did not catch it: it calls expectException() twice in one method. The claim part now returns without exception, and the header part (fn () => 0) throws the exception the second expectException() waits for, so the test passes with both versions of the class.

How to reproduce
use Jose\Component\Checker\CallableChecker;

$checker = new CallableChecker('scope', static fn (mixed $scope): mixed => $scope === 'invoices:write' ? true : 'scope not allowed');
$checker->checkClaim('invoices:read');

// 4.1.7: InvalidClaimException 'The "scope" claim is invalid.'
// 4.1.8 and later: no exception
Possible Solution
  • Restore !== true in both methods.
  • Skip SimplifyBoolIdenticalTrueRector for this file in .ci-tools/rector.php, otherwise the Rector job rewrites it again, and say in the constructor docblock that any result other than true is a refusal. Keeping the : bool return type in the docblock lets static analysers flag callables such as preg_match().
  • Replace the test with one claim test and one header test, each expecting a single exception, fed by a data provider: false, null, 0, 1, -1, a string, an array, an object.
  • Changelog: a callable that relies on truthiness, e.g. fn ($v) => preg_match('/…/', $v), refuses every value again, as before 4.1.8; it has to return a boolean.
Additional Context

Found by the Anthropic OSS Scanner (ANT-2026-IIOME38Z).

主要语言
PHP
星标
954
派生
119
平均合并
48 分钟
30 天内合并 PR
17

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

web-token/jwt-framework 的其他 Issue

查看 web-token/jwt-framework 的全部 Issue

相似的 Issue

更多 PHP Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。