Comments (11)
I have the same issue. If I use ->with($data) instead, it seems to work properly.
from inertia-laravel.
Yeah sorry folks, I had fixed this serious security bug back in June. See d09e6b1. Are you on the latest version of inertia-laravel?
The whole issue here was my using is_callable
instead of checking if it was a closure.
Before:
array_walk_recursive($props, function (&$prop) {
if (is_callable($prop)) {
$prop = App::call($prop);
}
});
After:
array_walk_recursive($props, function (&$prop) {
if ($prop instanceof Closure) {
$prop = App::call($prop);
}
});
Make sure you get on the latest version of inertia-laravel, and you'll be good.
from inertia-laravel.
I think the purpose might be to have lazy props (props that are only resolved when they're actually needed)?
Either way this is a pretty big security concern, for example a user entering phpinfo
as a value somewhere that'll be passed back to the Inertia component, will actually execute phpinfo()
!
from inertia-laravel.
All good. When it comes to security bugs, commotion is required.
Also, thanks @scottzirkel, you obviously found this in May already, thanks for reporting.
from inertia-laravel.
Having same issue. As a test, try and update a user's name to "dump." It will try to invoke the dump().
from inertia-laravel.
Yeah, any string that is callable will error out. Obviously this is not going to work since we're dealing with user provided data.
I checked in the PingCRM app, and it errors out there too. Was thinking I was doing something wrong. I'm not sure why the props are being called recursively like that, but everything works smooth with that commented out.
from inertia-laravel.
Funny, I did the same thing, I checked PingCRM to see if the mistake was on my end.
What do you think about using a specific key name, for all user input, that skips the recursive calls? I'm just worried about removing it completely in case the creator has some purpose for it that I don't know about.
from inertia-laravel.
Oh I have no doubt it serves a purpose, I just haven't sorted out what that is yet. I've had it commented out locally and have yet to see an error from it.
I feel like it should be the opposite, specify a key name for what should be called? Not sure. Without knowing it's true purpose, I'm kind of at a loss.
from inertia-laravel.
Sure enough, I hadn't refactored that. Thanks @Resin01!
from inertia-laravel.
For example, given the right circumstances you can get phpinfo
to execute:
from inertia-laravel.
My bad, composer dependencies were indeed locked on a certain commit 🙈 So sorry for the unnecessary commotion
from inertia-laravel.
Related Issues (20)
- Release notes for 1.0 could make it more clear that "Fix URL generation (#592)" is a breaking change HOT 5
- Ziggy2.0 and Laravel11 and Breeze for Inertia + React, TypeScript and SSR starter kit throws error on initial setting HOT 2
- assertInertia() fails when testing Inertia visits HOT 1
- Inertia components/hooks wrapped with redux Provider stopped working HOT 2
- client-side validation libraries HOT 1
- SSR high CPU usage HOT 1
- Serve Connection Reset HOT 1
- Default Layout HOT 1
- adding to HandleInertiaRequests->share array no longer works in version 1.2.0 HOT 5
- Running inertia:start-ssr continuosly fails with message 'Node.js v18.19.0' HOT 2
- Popups instead of redirects due to the first response to API request is randomly returned as "200 text/html" HOT 1
- Partial reload behaviour change in 1.1.0 causes lazy attributes not to be reloaded correctly HOT 2
- PreserveScroll not working without PreserveState for inertia form HOT 1
- How to update favicon, meta tags like descripiotn, keywords, openGraph(og) etc. HOT 1
- Using inertia component inside blade file HOT 1
- inertia returning encoded html in output for data-page HOT 5
- Problem with URL generation HOT 2
- SSR Not Rendering Content After Changing Default Port HOT 3
- [Feature] Does Inertia-Laravel support Nuxt.js? If not, will it in the future? HOT 1
- SSR rendering errors HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from inertia-laravel.