* test(security): add SQL interpolation classifier and ratchet baseline
Tokenizes each db_fetch/db_execute call and classifies its SQL argument as
prepared, static, qstr-escaped, opaque, identifier or value. The value bucket
is the migration target: a raw variable interpolated into value position. The
baseline records the current per-file value count so CI can block new ones.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci(security): gate new SQL value interpolation in quality workflow
Runs the interpolation audit in --check mode so a pull request that adds an
unparameterised value interpolation fails until it uses db_*_prepared(). Pins
setup-php to a commit SHA.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* refactor(security): split prebuilt SQL fragments from scalar interpolation
Cacti names query fragments consistently (sql_where, sql_join, ...). A variable
with such a name is a SQL snippet, not a bindable scalar, so it now lands in a
separate fragment category instead of inflating the value count. Extracts
scan_source() and a library-only include guard so the classifier can be unit
tested. Baseline value count drops from 373 to 300.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(security): cover the SQL interpolation classifier
Unit tests exercise each category (prepared, static, qstr, value, identifier,
fragment, opaque) against snippets, including IF EXISTS identifiers and mixed
scalar/fragment statements. An integration test runs the CLI against the tree
and asserts the committed baseline stays in sync.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(tooling): gate chdir to CLI runs and align checkout version
The audit is require'd by the unit tests in library mode; running chdir() at
load time leaked a working-directory change into other tests. Gate it behind
the library sentinel. Also aligns the ratchet job's checkout to the version the
rest of the workflow uses.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* style(tooling): use PHP 8 string helpers and short array syntax in audit
Switches the classifier to str_starts_with/str_ends_with/str_contains and short
array and list syntax, matching the idiom the rest of the codebase uses. Output
is unchanged.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix installer failure handling
* style(lib): align installer assignment per cs-fixer
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
