[php] Add laravel weblog#6871
Open
estringana wants to merge 28 commits into
Open
Conversation
Contributor
|
|
|
estringana
force-pushed
the
estringana/add-laravel-weblog
branch
from
094c93a to
1351f06
Compare
estringana
force-pushed
the
estringana/add-laravel-weblog
branch
4 times, most recently
from
4db6332 to
478d31b
Compare
estringana
commented
May 25, 2026
| series_eval = find_series("appsec", "rasp.rule.match", is_metrics=True) | ||
| assert series_eval | ||
| assert series_eval[0]["points"][0][1] == 3.0 | ||
| assert any(validate_metric("rasp.rule.match", "lfi", s) and s["points"][0][1] == 3.0 for s in series_eval), [ |
Contributor
Author
There was a problem hiding this comment.
All other validations on this file are done this way. This one was relying on the right order but it can't be preserverd 100% of the times
estringana
commented
May 25, 2026
Comment on lines
+1164
to
+1173
| def login_failure_includes_usr_exists_meta() -> bool: | ||
| """True when this library and weblog emit usr.exists on login failure spans.""" | ||
| return context.library not in libs_without_user_exist and context.weblog_variant not in weblogs_without_user_exist | ||
|
|
||
|
|
||
| def login_failure_includes_usr_id_meta() -> bool: | ||
| """True when this library and weblog emit usr.id on login failure spans.""" | ||
| return ( | ||
| context.library not in libs_without_user_id_on_failure | ||
| and context.weblog_variant not in weblogs_without_user_id_on_failure |
Contributor
Author
There was a problem hiding this comment.
These two allow to have things working at a language level and not a a framework level
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5163113baf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| tests/appsec/rasp/test_sqli.py::Test_Sqli_Mandatory_SpanTags: | ||
| - weblog_declaration: | ||
| "*": missing_feature | ||
| laravel11x: v1.6.2 |
There was a problem hiding this comment.
For the new laravel11x activation, the enabled tests call /rasp/sqli in tests/appsec/rasp/test_sqli.py, but I checked utils/build/docker/php/weblogs/laravel11x/routes/web.php and there is no Laravel route for /rasp/sqli (only the /db SQL helper routes exist). When these tests run with WEBLOG_VARIANT=laravel11x, the request will hit the 404 handler and validate_span_tags will inspect a root span without the SQLi RASP metrics, so these tests fail instead of validating span tags.
Useful? React with 👍 / 👎.
cataphract
reviewed
May 29, 2026
estringana
force-pushed
the
estringana/add-laravel-weblog
branch
from
b3b3de8 to
354818a
Compare
estringana
force-pushed
the
estringana/add-laravel-weblog
branch
2 times, most recently
from
8f78736 to
d94d9fa
Compare
estringana
changed the title
cataphract
reviewed
Jun 16, 2026
Contributor
There was a problem hiding this comment.
Two threads still need resolution:
-
User.phpoffsetExistsoverride -- The workaround hides a real ddtrace bug: the AppSec spec requiresusername/loginto be preferred overemailwhen resolvingusr.login, but the PHP integration currently checksemailfirst. OverridingoffsetExistsin the weblog masks this instead of surfacing it. The fix belongs in the tracer, not her -- mark XFAIL and create a jira ticket. -
LoginController.phpcallSdk()method -- Please inline this. It wraps single-line SDK calls, takes a parameter that goes unused in one branch, and makes the code harder to follow rather than easier.
On the CI failures: all PHP variants (apache-mod-7.0 through php-fpm-8.5, including laravel11x) are failing
The branch is also behind main and will need a rebase / merge.
estringana
force-pushed
the
estringana/add-laravel-weblog
branch
2 times, most recently
from
7d83878 to
0ef95fe
Compare
Contributor
Author
|
@cbeauchesne the PR is ready |
Contributor
Author
|
@cataphract pr is ready |
estringana
force-pushed
the
estringana/add-laravel-weblog
branch
from
6c3871c to
1a14aa8
Compare
|
estringana
force-pushed
the
estringana/add-laravel-weblog
branch
from
9ef5c68 to
b90b75a
Compare
estringana
force-pushed
the
estringana/add-laravel-weblog
branch
from
b90b75a to
f36a8eb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
This PR lays the groundwork for multi-framework PHP weblog testing by restructuring the existing plain-PHP weblog and introducing Laravel 11.x as the first framework variant.
common/intoweblogs/plain/to establish a modularweblogs/<framework>/pattern.common/is now reserved for truly shared infrastructure (installation scripts, config)Workflow
🚀 Once your PR is reviewed and the CI green, you can merge it!
🛟 #apm-shared-testing 🛟
Reviewer checklist
tests/ormanifests/is modified ? I have the approval from R&P teambuild-XXX-imagelabel is present