v2.35.1 — a lint that said healthier than it was

v2.35.1

Two gaps in the rate-limit lint that 2.35.0 added. Both were found in review, and both made firewall-check --lint report a config as healthier than it was.

PHP 8.1–8.5 supported. Lint only: nothing the firewall enforces changes, and there are no new configuration keys.

What changes on upgrade

• --lint may report a new warning on a config it passed before: Rule "X": the entry for /login never runs, because /log* comes first and matches it. That entry never ran; now it's reported.
• One misleading warning goes away. For a config like the one below, --lint said "/login is rate limited by identity, but not by address", the reverse of what the firewall did.
• A disabled rate-limit rule no longer counts as coverage, so a config that relied on one now gets the "identity, but not by address" warning it always should have.

Fixed

• An earlier pattern that covers a later entry was not reported (#437, #439). A rate limit uses the first entry in its config: whose pattern matches. 2.35.0 reported a second entry only when the paths were identical, so these hid a later entry silently:

  config:
    - { path: "/log*", rate: 50, sample: 300 }                  # takes every /login request
    - { path: /login, rate: 5, sample: 300, key: [post.name] }  # never runs

  The same happened with /login before /LOGIN, since paths ignore case as of 2.35.0. Both are now reported, and the warning names the entry that takes the request. Coverage is judged by the entry that actually runs, and across rules it ignores case. Only certain cases are reported; patterns written as a regex are left alone, since whether one arbitrary regex covers another can't be decided reliably. The linter now asks the rate limit's own pattern matcher (RateLimit::patternToRegex(), now public), so the two can't disagree.

• A disabled rule counted as address coverage (#438, #439). With the address-keyed rule set to enable: false, the "identity, but not by address" warning disappeared. So switching the address limit off, for example while debugging, silenced the warning that said brute-force protection was gone. Disabled rules are now skipped; a missing enable is on, as the firewall reads it.

Full changelog: v2.35.0...v2.35.1