**Enhance input validation and error handling across APIs**

- 🛠️ Refactored controllers to utilize `FiltersNumericIds` concern, ensuring secure numeric ID filtering and avoiding type-sensitive errors in queries.
-  Added feature tests to validate robust input hardening for non-numeric or malformed query parameters (`user_id`, `selected[]`).
- 🔒 Introduced `PublicPropertyNotFoundException` handling in Livewire, returning 400 for invalid property probes and suppressing unnecessary log entries.
-  Updated `MeetupEventController` to handle invalid date formats gracefully, aborting with a 400 response instead of 500.
-  Expanded exception handling pipeline for enhanced resilience against malformed input, bot noise, and exploitable probes.
This commit is contained in:
HolgerHatGarKeineNode
2026-06-08 02:53:44 +02:00
parent 3b93e22e95
commit 3cad5f5636
11 changed files with 132 additions and 15 deletions
@@ -3,6 +3,7 @@
use Illuminate\Support\Facades\Log;
use Illuminate\Support\Facades\Route;
use Livewire\Exceptions\MethodNotFoundException;
use Livewire\Exceptions\PublicPropertyNotFoundException;
use Livewire\Features\SupportLifecycleHooks\DirectlyCallingLifecycleHooksNotAllowedException;
use Livewire\Mechanisms\HandleComponents\CorruptComponentPayloadException;
@@ -44,6 +45,28 @@ it('still surfaces genuine method-not-found bugs', function () {
expect($this->get('/_test/livewire-real-method-not-found')->status())->not->toBe(400);
});
it('returns 400 for setting an undeclared public property instead of 500', function () {
Route::get('/_test/livewire-undeclared-property', function () {
throw new PublicPropertyNotFoundException('value', 'welcome');
});
expect($this->get('/_test/livewire-undeclared-property')->status())->toBe(400);
});
it('does not report undeclared-property probes to the logs', function () {
Log::spy();
Route::get('/_test/livewire-undeclared-property-log', function () {
throw new PublicPropertyNotFoundException('value', 'welcome');
});
$this->get('/_test/livewire-undeclared-property-log')->assertStatus(400);
Log::shouldNotHaveReceived('error');
Log::shouldNotHaveReceived('critical');
Log::shouldNotHaveReceived('emergency');
});
it('does not report corrupt Livewire snapshot payloads', function () {
Log::spy();