Skip to content

3.66.0

Choose a tag to compare

View all tags
@spryker-release-bot spryker-release-bot released this 06 Aug 08:56
· 4 commits to master since this release
3.66.0
d54a7ab

Included commits: 3.65.0...3.66.0

Improvements

  • Introduced TestifyConstants::IS_DATA_BUILDER_RULE_EVAL_ENABLED and TestifyConstants::DATA_BUILDER_ALLOWED_RULE_FUNCTIONS constants to control data builder rule execution behavior as part of security issue fixes.
  • Introduced TestifyConfig::isDataBuilderRuleEvalEnabled() and TestifyConfig::getDataBuilderAllowedRuleFunctions() to allow projects to disable eval()-based rule execution in data builders and restrict allowed PHP functions, reducing security exposure in test environments.
  • Replaced eval()-based rule parsing in AbstractDataBuilder with a safe token-based parser that restricts execution to Faker formatters, literal arguments, and allow-listed functions when eval is disabled.
Assets 2
Loading