This is a security release and all users are advised to update their install(s) as soon as possible.
Changed
Other
- Various housekeeping.
Fixed
Abstract Sniffs
- SECURITY FIX: Running a sniff which uses the
AbstractArrayDeclarationSniff::getActualArrayKey()method over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. #774
For more details, see the security advisory.
Thanks go to @rodrigoprimo for responsibly disclosing the vulnerability. - The
AbstractArrayDeclarationSniff::getActualArrayKey()method now handles exceptions seen when evaluating array keys more gracefully. #775
Utils
- The
Arrays::getDoubleArrowPtr()method did not recognize that, while rare, an array key can contain a (nested) array. #771
Contributors
rodrigoprimo