feat: Laravel integration for gksh/bitmask #1
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The package provides: - A `BitmaskCast` for Eloquent models to seamlessly cast integer values to and from `Bitmask` objects. - Eloquent scopes (`HasBitmaskScopes`) for querying bitmask columns with various conditions (has flag, has all flags, has any flag, etc.). - A `make:bitmask-flags` Artisan command to generate bitmask enum classes. - A `ValidBitmask` validation rule to ensure input values conform to bitmask constraints, optionally tied to an enum. - Blade directives for conditional rendering based on bitmask flags. - Custom Blueprint macros for defining bitmask columns in migrations. - Comprehensive unit tests covering all functionalities.
Contributor
Author
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| { | ||
| $value = maskValue($flag); | ||
|
|
||
| return $query->whereRaw("{$column} & ? = ?", [$value, $value]); |
There was a problem hiding this comment.
SQL injection vulnerability: $column is directly interpolated into raw SQL without sanitization. An attacker could pass malicious input like permissions; DROP TABLE users-- as the column name.
Wrap the column name with backticks or use DB::raw() to prevent injection:
Suggested change
| return $query->whereRaw("{$column} & ? = ?", [$value, $value]); | |
| return $query->whereRaw("`{$column}` & ? = ?", [$value, $value]); |
Prompt To Fix With AI
This is a comment left during a code review.
Path: src/Concerns/HasBitmaskScopes.php
Line: 28:28
Comment:
SQL injection vulnerability: `$column` is directly interpolated into raw SQL without sanitization. An attacker could pass malicious input like `permissions; DROP TABLE users--` as the column name.
Wrap the column name with backticks or use `DB::raw()` to prevent injection:
```suggestion
return $query->whereRaw("`{$column}` & ? = ?", [$value, $value]);
```
How can I resolve this? If you propose a fix, please make it concise.| { | ||
| $value = $this->combinedMaskValue($flags); | ||
|
|
||
| return $query->whereRaw("{$column} & ? = ?", [$value, $value]); |
There was a problem hiding this comment.
SQL injection vulnerability: $column needs sanitization.
Suggested change
| return $query->whereRaw("{$column} & ? = ?", [$value, $value]); | |
| return $query->whereRaw("`{$column}` & ? = ?", [$value, $value]); |
Prompt To Fix With AI
This is a comment left during a code review.
Path: src/Concerns/HasBitmaskScopes.php
Line: 42:42
Comment:
SQL injection vulnerability: `$column` needs sanitization.
```suggestion
return $query->whereRaw("`{$column}` & ? = ?", [$value, $value]);
```
How can I resolve this? If you propose a fix, please make it concise.| { | ||
| $value = $this->combinedMaskValue($flags); | ||
|
|
||
| return $query->whereRaw("{$column} & ? != 0", [$value]); |
There was a problem hiding this comment.
SQL injection vulnerability: $column needs sanitization.
Suggested change
| return $query->whereRaw("{$column} & ? != 0", [$value]); | |
| return $query->whereRaw("`{$column}` & ? != 0", [$value]); |
Prompt To Fix With AI
This is a comment left during a code review.
Path: src/Concerns/HasBitmaskScopes.php
Line: 56:56
Comment:
SQL injection vulnerability: `$column` needs sanitization.
```suggestion
return $query->whereRaw("`{$column}` & ? != 0", [$value]);
```
How can I resolve this? If you propose a fix, please make it concise.| { | ||
| $value = maskValue($flag); | ||
|
|
||
| return $query->whereRaw("{$column} & ? != ?", [$value, $value]); |
There was a problem hiding this comment.
SQL injection vulnerability: $column needs sanitization.
Suggested change
| return $query->whereRaw("{$column} & ? != ?", [$value, $value]); | |
| return $query->whereRaw("`{$column}` & ? != ?", [$value, $value]); |
Prompt To Fix With AI
This is a comment left during a code review.
Path: src/Concerns/HasBitmaskScopes.php
Line: 69:69
Comment:
SQL injection vulnerability: `$column` needs sanitization.
```suggestion
return $query->whereRaw("`{$column}` & ? != ?", [$value, $value]);
```
How can I resolve this? If you propose a fix, please make it concise.| { | ||
| $value = $this->combinedMaskValue($flags); | ||
|
|
||
| return $query->whereRaw("{$column} & ? = 0", [$value]); |
There was a problem hiding this comment.
SQL injection vulnerability: $column needs sanitization.
Suggested change
| return $query->whereRaw("{$column} & ? = 0", [$value]); | |
| return $query->whereRaw("`{$column}` & ? = 0", [$value]); |
Prompt To Fix With AI
This is a comment left during a code review.
Path: src/Concerns/HasBitmaskScopes.php
Line: 83:83
Comment:
SQL injection vulnerability: `$column` needs sanitization.
```suggestion
return $query->whereRaw("`{$column}` & ? = 0", [$value]);
```
How can I resolve this? If you propose a fix, please make it concise.| "illuminate/support": "^10.0|^11.0|^12.0" | ||
| }, | ||
| "require-dev": { | ||
| "laravel/pint": "^1.18", |
There was a problem hiding this comment.
laravel/prompts is used in production code (MakeBitmaskFlagsCommand) but listed in require-dev. Move it to require:
Suggested change
| "laravel/pint": "^1.18", | |
| "illuminate/support": "^10.0|^11.0|^12.0", | |
| "laravel/prompts": "^0.1|^0.2|^0.3" |
Prompt To Fix With AI
This is a comment left during a code review.
Path: composer.json
Line: 20:20
Comment:
`laravel/prompts` is used in production code (`MakeBitmaskFlagsCommand`) but listed in `require-dev`. Move it to `require`:
```suggestion
"illuminate/support": "^10.0|^11.0|^12.0",
"laravel/prompts": "^0.1|^0.2|^0.3"
```
How can I resolve this? If you propose a fix, please make it concise.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The package provides:
BitmaskCastfor Eloquent models to seamlessly cast integer values to and fromBitmaskobjects.HasBitmaskScopes) for querying bitmask columns with various conditions (has flag, has all flags, has any flag, etc.).make:bitmask-flagsArtisan command to generate bitmask enum classes.ValidBitmaskvalidation rule to ensure input values conform to bitmask constraints, optionally tied to an enum.Greptile Overview
Greptile Summary
This PR adds Laravel integration for the
gksh/bitmaskpackage, providing Eloquent casts, query scopes, validation rules, Blade directives, and migration helpers for working with bitmask fields.Key Changes:
BitmaskCastfor automatic casting between integers and Bitmask objects in Eloquent modelsHasBitmaskScopestrait with query scopes for filtering records by bitmask flagsValidBitmaskvalidation rule with optional enum-based range checkingmake:bitmask-flagsArtisan command for generating bitmask enum classes@hasBitmaskFlag,@hasAnyBitmaskFlag,@hasAllBitmaskFlags)tinyBitmask,smallBitmask,mediumBitmask,bitmask) for migrationsCritical Issues Found:
HasBitmaskScopesmethods - column names are interpolated without sanitizationlaravel/promptsdependency is inrequire-devbut used in production codearray_sum()used instead of bitwise OR for combining bitmask values (works but semantically incorrect)Confidence Score: 1/5
HasBitmaskScopestrait that could allow attackers to execute arbitrary SQL queries. Additionally, incorrect dependency configuration will cause runtime errors in production environments.src/Concerns/HasBitmaskScopes.php(SQL injection) andcomposer.json(dependency misplacement)Important Files Changed
File Analysis
Sequence Diagram
sequenceDiagram participant App as Laravel Application participant SP as TransistorServiceProvider participant Model as Eloquent Model participant Cast as BitmaskCast participant Scope as HasBitmaskScopes participant DB as Database participant Bitmask as Bitmask Object Note over App,SP: Service Provider Registration App->>SP: boot() SP->>SP: registerCommands() SP->>SP: registerBladeDirectives() SP->>SP: registerValidationRules() SP->>SP: registerBlueprintMacros() Note over Model,Bitmask: Eloquent Cast (Retrieval) Model->>Cast: get(model, key, value, attributes) Cast->>Cast: Check if value is null Cast->>Cast: Convert to int Cast->>Bitmask: Create Bitmask instance based on size Bitmask-->>Model: Return Bitmask object Note over Model,Bitmask: Eloquent Cast (Storage) Model->>Cast: set(model, key, value, attributes) Cast->>Cast: Check value type alt value is Bitmask Cast->>Bitmask: value() Bitmask-->>Cast: Return integer else value is int Cast->>Cast: Cast to int end Cast-->>Model: Return integer for storage Note over Model,DB: Query Scopes App->>Model: whereHasBitmaskFlag('permissions', flag) Model->>Scope: scopeWhereHasBitmaskFlag(query, column, flag) Scope->>Scope: maskValue(flag) Scope->>DB: whereRaw("column & ? = ?", [value, value]) DB-->>App: Return filtered results(3/5) Reply to the agent's comments like "Can you suggest a fix for this @greptileai?" or ask follow-up questions!