Looking for PHP security tips? Read our list of PHP security best practices and get a head start on your PHP security strategy.

Using PSR-3 placeholders properly

Larry
26 February 2023 – 10:26am

In this blog, we give an overview of PHP CVE-2022-31631, including who it impacts, and how to mitigate this potentially dangerous PHP vulnerability.

I have just returned from the 2023 edition of PHPUK and, as always, found it a valuable conference to catch up with the PHP community and find out what’s happening in the ecosystem.

This year, I was accepted to speak on the differences between RPC, REST and GraphQL APIs and was surprised and gratified that the room was at full capacity. Thank you to everyone that attended; I hope that you learnt something useful. I think that good APIs matter and am fairly pragmatic about implementations. In general, I would far rather that you wrote a really good RPC API than a bad GraphQL one for example.

The developer experience of an API matters, which is why it’s important that your API follows best practices for the architecture that you choose. For instance, follow the Relay pagination specification if you are writing a GraphQL API, or follow HTTP semantics and use status codes properly if you are writing a RESTful API. This stuff is key as developer word-of-mouth about how good your API is to use is valuable marketing.

The conference had many good talks. For instance Ian’s talk on PHP on Lambda provided valuable information and Pauline reprised her excellent talk on Git to fill the slot after a speaker pulled out. Pauline also spoke about the decentralised web, a talk I recommend that you seek out when the videos are published. All in all, the standard of talks was very high and I heard a good buzz about lots of them.

In our world of remote work, in an industry where interruptions are disruptive to the flow state that we get into when working, I can’t emphasise enough how useful the connections we make at in-person conferences can be. It’s a fantastic way to connect and talk about issues directly relevant to your work life and get other people’s thoughts with more context than is usually possible in other mediums.

The people I have met at conferences have materially affected my career for the better and I encourage everyone to try to attend a conference that’s relevant for their work at least per year.

In 2019 I started Bad Gateway as a software development agency. Last year we
grew all the way to 7 people. It was crazy challenging, especially with Covid
in the mix; but ultimately could not get the company into a good financial
state to be able to carry on.

Big thanks to my co-workers and partners Ju, Becky, Phil,
Michael, Siep, Richard and Syed.
I’m incredibly grateful you came on this journey with me. We shared some
tears, exchanged some words but mostly had lots of laughs. Despite the
challenges I feel my relationship with you has only strengthened and I wish
you well in the next steps of your career.

Also thank you to our customers and especially Underknown who’ve stuck
with us since the start.

Despite this outcome, I have a hard time seeing the last few years as a
failure. It’s been hella fun, and I feel we stuck to our values even in times
of crisis. Off to the next adventure.

Get an overview of our 2023 PHP report, including key findings and analysis on the top trends in PHP development today.

I’m a maintainer of several dozen open source libraries. One thing I’ve
always done is maintain a hand-written changelog.

Here’s an example from a12n-server

0.22.0 (2022-09-27)
-------------------

Warning note for upgraders. This release has a database migration on the
`oauth2_tokens` table. For most users this is the largest table, some
downtime may be expected while the server runs its migrations.

* #425: Using a `client_secret` is now supported with `authorization_code`, and it's read from either the request body or HTTP Basic Authorization header.
* The service now keeps track when issuing access tokens, whether those tokens have used a `client_secret` or not, which `grant_type` was used to issue them and what scopes were requested. This work is done to better support OAuth2 scopes in the future, and eventually OpenID Connect.
* Fixed broken 'principal uri' in introspection endpoint response.
* OAuth2 service is almost entirely rewritten.
* The number of tokens issued is now displayed on the home page.
* Large numbers are now abbreviated with `K` and `M`.
* #426: Updated to Curveball 0.20.
* #427: Typescript types for the database schema are now auto-generated with `mysql-types-generator`.

These are all written in Markdown. You might think: isn’t Git also a log? Why
bother hand-writing these?

The reason is that the audience for these is a bit different. I want to bring
attention to the things that are the most important for the end-user, and
focus on the impact of the change to the user.

I thought it would be handy to write a CLI tool that makes it a bit easier to
maintain these. So, I did!. If you are curious what kind of technology
choices went into this, read on.

Goals and features

The tool should be able to do the following:

• Reformat changelogs (a bit like prettify) (changelog format)
• Add an entry via the command line (changelog add --minor -m "New feature").
• Automatically set the release date (changelog release)
• Pipe a log of a specific version to STDOUT, so it can be used by other tools
  (like integrating with github releases).

I also had a bunch of a non-functional requirements:

• Use the latest Node features.
• Use up to date Javascript standards and features (ESM).
• Avoid dependendencies unless it’s unreasonable to do so.
• Make it low maintanance.

Want to find the finished tool right now? It’s open source so just go to Github.

The implementation

ESM & Typescript

Ecmascripts modules worked really well here. It’s a small change of habits,
but the general recommendation I would have is to just save your files
as .mjs and start using it.

Here’s the first few lines of parse.mjs:

// @ts-check
import { Changelog, VersionLog } from "./changelog.mjs";
import { readFile } from 'node:fs/promises'; /** * @param {string} filename * @returns {Promise<Changelog>} */
export async function parseFile(

Truncated by Planet PHP, read more at the original (another 27805 bytes)