refactor(Request): Enhance getRemoteIP() method to validate the remote IP address and improve handling of server parameters. Add tests for retrieving remote IP from PSR-7 server parameters in ServerParamsPsr7Test class.
#77
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ote IP address and improve handling of server parameters. Add tests for retrieving remote IP from PSR-7 server parameters in `ServerParamsPsr7Test` class.
WalkthroughThe changes introduce validation for remote IP addresses in the Changes
Sequence Diagram(s)sequenceDiagram
participant Test as Test Case
participant Request as Request Object
participant PSR7 as PSR-7 Adapter
Test->>Request: call getRemoteIP()
Request->>PSR7: get 'REMOTE_ADDR' server param
PSR7-->>Request: return value (string or other)
Request->>Request: validate with filter_var()
alt Valid IP
Request-->>Test: return IP string
else Invalid IP
Request-->>Test: return null
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #77 +/- ##
===========================================
Coverage 100.00% 100.00%
- Complexity 312 313 +1
===========================================
Files 12 12
Lines 786 790 +4
===========================================
+ Hits 786 790 +4 ☔ View full report in Codecov by Sentry. |
Member
Author
|
@coderabbitai I wonder if we could replace the |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 18777 🏁 Script executed: Length of output: 53081 @terabytesoftw, yes, that's a great idea! The data provider pattern would make the tests more consistent and comprehensive. Here's how you could refactor the 1. Add a new data provider in
|
…verage for `getRemoteIP()` method with various input scenarios.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
tests/provider/RequestProvider.php (2)
880-883: Unify data provider key naming style (nitpick)Other providers use "numeric string" (with space). Consider aligning this key to keep naming consistent.
- 'numeric-string' => [ + 'numeric string' => [ '123', null, ],
822-893: Consider adding edge-form cases (ports, brackets, whitespace) to harden coverageThese forms are commonly seen in headers but should be rejected for REMOTE_ADDR; adding them makes intent explicit and avoids regressions.
return [ + 'invalid-ip' => [ + '999.999.999.999', + null, + ], + 'ipv4-with-port' => [ + '10.0.0.1:8080', + null, + ], + 'ipv6-bracketed' => [ + '[::1]', + null, + ], + 'ipv6-with-port' => [ + '[::1]:443', + null, + ], + 'spaces-around' => [ + ' 127.0.0.1 ', + null, + ], + 'spaces-only' => [ + ' ', + null, + ], + 'zero-address' => [ + '0.0.0.0', + '0.0.0.0', + ], ];If you prefer to be lenient and accept whitespace-wrapped IPs, we can instead trim in
getRemoteIP()and adjust expectations—let me know.src/http/Request.php (1)
500-509: Simplify validation and drop redundant flags
FILTER_VALIDATE_IPvalidates both IPv4 and IPv6 by default. You can streamline the logic and return the validated value directly.- if (is_string($remoteIP) === false) { - return null; - } - - if (filter_var($remoteIP, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_IPV6) === false) { - return null; - } - - return $remoteIP; + $validated = is_string($remoteIP) ? filter_var($remoteIP, FILTER_VALIDATE_IP) : false; + return $validated !== false ? $validated : null;tests/adapter/ServerParamsPsr7Test.php (1)
163-186: Data-driven test aligns with provider and new validationCovers many shapes via RequestProvider::remoteIPCases and clear assertion messages. Once you add edge-form cases to the provider (ports/brackets/whitespace), this test will cover them automatically.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
composer.json(1 hunks)src/http/Request.php(3 hunks)tests/adapter/ServerParamsPsr7Test.php(1 hunks)tests/adapter/ServerRequestAdapterTest.php(0 hunks)tests/provider/RequestProvider.php(1 hunks)
💤 Files with no reviewable changes (1)
- tests/adapter/ServerRequestAdapterTest.php
🧰 Additional context used
🧠 Learnings (4)
📓 Common learnings
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods (lines 28 and 32), so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods, so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1564-1578
Timestamp: 2025-07-20T16:33:57.495Z
Learning: The TestCase class in yii2-extensions/psr-bridge automatically handles $_SERVER superglobal cleanup by saving its original state before each test and restoring it afterward in setUp() and tearDown() methods. Manual $_SERVER cleanup in individual test methods is unnecessary when extending this TestCase.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/TestCase.php:23-27
Timestamp: 2025-08-08T15:24:06.045Z
Learning: In yii2-extensions/psr-bridge (tests/TestCase.php), maintainer preference: it’s acceptable to use random-looking strings for test-only constants like COOKIE_VALIDATION_KEY; no need to replace with an obviously non-secret value unless CI/secret scanners become problematic.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge tests, prefer using self::COOKIE_VALIDATION_KEY from tests/TestCase over hardcoded 'cookieValidationKey' strings to avoid secret scanners FP and improve maintainability.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#71
File: tests/adapter/ServerRequestAdapterTest.php:2215-2215
Timestamp: 2025-08-08T15:28:00.137Z
Learning: In yii2-extensions/psr-bridge, tests extend tests/TestCase which defines a protected const COOKIE_VALIDATION_KEY. Test code should use self::COOKIE_VALIDATION_KEY instead of hardcoded cookieValidationKey literals.
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#64
File: tests/http/StatelessApplicationTest.php:1939-1967
Timestamp: 2025-08-06T22:52:05.608Z
Learning: In yii2-extensions/psr-bridge tests, when testing specific component methods like Request::resolve(), it's necessary to call $app->handle($request) first to initialize all application components before testing the method in isolation. This ensures proper component lifecycle initialization.
📚 Learning: 2025-07-20T16:33:57.495Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1564-1578
Timestamp: 2025-07-20T16:33:57.495Z
Learning: The TestCase class in yii2-extensions/psr-bridge automatically handles $_SERVER superglobal cleanup by saving its original state before each test and restoring it afterward in setUp() and tearDown() methods. Manual $_SERVER cleanup in individual test methods is unnecessary when extending this TestCase.
Applied to files:
tests/adapter/ServerParamsPsr7Test.php
📚 Learning: 2025-07-20T16:35:15.341Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods (lines 28 and 32), so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Applied to files:
tests/adapter/ServerParamsPsr7Test.php
📚 Learning: 2025-07-20T16:35:15.341Z
Learnt from: terabytesoftw
PR: yii2-extensions/psr-bridge#6
File: tests/http/RequestTest.php:1536-1552
Timestamp: 2025-07-20T16:35:15.341Z
Learning: In the yii2-extensions/psr-bridge project, the base TestCase class already handles $_SERVER cleanup in setUp() and tearDown() methods, so individual test methods that extend TestCase don't need manual $_SERVER restoration.
Applied to files:
tests/adapter/ServerParamsPsr7Test.php
🧬 Code Graph Analysis (1)
tests/adapter/ServerParamsPsr7Test.php (3)
src/http/Request.php (2)
Request(54-823)getRemoteIP(495-512)tests/support/FactoryHelper.php (2)
FactoryHelper(46-268)createRequest(68-89)tests/provider/RequestProvider.php (1)
RequestProvider(7-1281)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: mutation / PHP 8.3-ubuntu-latest
- GitHub Check: mutation / PHP 8.3-ubuntu-latest
🔇 Additional comments (5)
composer.json (1)
14-14: Explicitly requiring ext-filter is appropriate given filter_var usageGood addition. It aligns composer requirements with the runtime need introduced in Request::getRemoteIP().
tests/provider/RequestProvider.php (1)
822-893: Comprehensive IP input coverage matches getRemoteIP() validationThe provider cases align well with strict
filter_var(FILTER_VALIDATE_IP)behavior, including IPv4/IPv6 and invalid types/values. LGTM.src/http/Request.php (2)
18-18: Importing filter_var function is correctMatches the new validation logic and keeps the call unqualified and clear.
480-489: Docblock accurately reflects behavior changeClarifies source (PSR-7 server params) and null on invalid—good update.
tests/adapter/ServerParamsPsr7Test.php (1)
140-161: Override behavior test is solidConfirms PSR-7 server params take precedence over global $_SERVER. Base TestCase auto-restores $_SERVER, so no extra cleanup needed.
…l test scenarios for `IP` validation, including invalid `IP`, `IPv4` with port, and `IPv6` formats.
Member
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
Member
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Bug Fixes
Chores
Tests