archtechx/tenancy
1
0
Fork 0
mirror of https://github.com/archtechx/tenancy.git synced 2026-06-20 22:54:05 +00:00
Code Activity

improve docblocks for allowlists

Browse source
This commit is contained in:
Samuel Stancl 2026-06-08 16:20:19 -07:00
parent 13e32dd6ab
commit fbffeb84b3
No known key found for this signature in database
GPG key ID: BA146259A1E16C57
1 changed files with 4 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/Database/Concerns/ValidatesDatabaseParameters.php
View file

@ -24,8 +24,8 @@ trait ValidatesDatabaseParameters
* Used as the default allowlist in validateParameter(), which validates non-password
* parameters such as database names or usernames.
*
* Since special characters are not used in non-password parameters commonly,
* we can be more strict about them to prevent SQL injection and other related issues.
* Since non-password parameters don't need to use as many special characters, we use
* a stricter allowlist here.
*/
protected function allowedParameterCharacters(): string
{
@ -35,13 +35,8 @@ trait ValidatesDatabaseParameters
/**
* Characters allowed in database user passwords.
*
* Parameters are always quoted in the SQL statements, so it's safe
* to allow a wider range of characters, as long as it doesn't include
* characters that can break out of the quoted SQL strings (so e.g.
* ', ", \, and ` aren't allowed).
*
* The allowlist is less strict for passwords than for other parameters
* because it's more common to use special characters in passwords.
* The allowlist for passwords is less strict than for other parameters
* because it's more common to use more special characters in passwords.
*/
protected function allowedPasswordCharacters(): string
{