🔒 Fix Loose Type Comparison Vulnerability in Cif.php#212
🔒 Fix Loose Type Comparison Vulnerability in Cif.php#212ronanguilloux merged 1 commit intomasterfrom
Conversation
This commit changes loose equality (`==`) to strict equality (`===`) in `src/IsoCodes/Cif.php` when validating control digits. Loose comparison is vulnerable to PHP type juggling, where strings like `"A"` evaluate to `true` when compared loosely with integer `0`. Explicit type casting to `(string)` is applied to numerical control digits before comparing them strictly with characters from the input string to ensure correct validation and avoid regressions. Tests have been expanded to include edge cases exploiting this vulnerability to verify the fix works as expected. Co-authored-by: ronanguilloux <313677+ronanguilloux@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🎯 What: The vulnerability fixed is a Loose Type Comparison in
⚠️ Risk: The potential impact if left unfixed is that invalid CIFs could bypass validation due to PHP type juggling (e.g. comparing string "A" to integer 0 resulted in true in older PHP versions).
src/IsoCodes/Cif.phpwhere==was used instead of===to validate CIF control digits.🛡️ Solution: How the fix addresses the vulnerability is by replacing
==with===and explicitly casting integer control digits to(string)before comparison, preventing arbitrary strings from passing validation via coercion while maintaining correctness for valid inputs. A new test case (A0874542A) has been added to ensure this edge case is caught and blocked.PR created automatically by Jules for task 12457909117861872661 started by @ronanguilloux