toga-ai 1.0.348 → 1.0.349
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -6,7 +6,7 @@ project: _Underscore
|
|
|
6
6
|
client: shared
|
|
7
7
|
type: feature
|
|
8
8
|
status: active
|
|
9
|
-
updated: 2026-07-
|
|
9
|
+
updated: 2026-07-15
|
|
10
10
|
owners: ["dfranks"]
|
|
11
11
|
files:
|
|
12
12
|
- _underscore/Error.php
|
|
@@ -113,9 +113,30 @@ not extend the inline-persist branch.
|
|
|
113
113
|
Logs DB, two dbchanges2 `Logs/` migrations that both `CREATE TABLE Issues`/`Events` will
|
|
114
114
|
collide ("table already exists"). Only **one** migration may create the shared tables;
|
|
115
115
|
later migrations only `ALTER`.
|
|
116
|
+
- **Cross-tenant secret exposure when captured context lands in the shared Core Logs DB.**
|
|
117
|
+
Moving the Issue/Event sink from a per-client Logs DB to the *shared* Core Logs DB widens
|
|
118
|
+
the blast radius of anything captured in `context`. A pre-migration `print_r($GLOBALS, true)`
|
|
119
|
+
dump (session tokens, auth headers, credentials from superglobals) that was acceptable while
|
|
120
|
+
per-tenant becomes a cross-tenant leak once every tenant can read the shared table.
|
|
121
|
+
`_underscore/Error.php::redactSensitiveContext()` recursively redacts superglobal keys
|
|
122
|
+
matching sensitive fragments (`password/secret/token/authorization/auth/apikey/credential/`
|
|
123
|
+
`cookie/session/jwt/private`) **before** persisting. Rule: sanitize captured context at the
|
|
124
|
+
point you move a log sink from per-client to shared.
|
|
125
|
+
- **Strict-mysqli varchar overflow silently drops the Issue/Event row.** `_Error::initialize()`
|
|
126
|
+
sets `mysqli_report(MYSQLI_REPORT_STRICT)`, so assigning an over-255-char value to a
|
|
127
|
+
`varchar(255)` column (`errorMessage`, `subject`) **throws** on `->save()`. Because the write
|
|
128
|
+
happens inside the error handler's `catch(Throwable)`, the throw is swallowed and the row is
|
|
129
|
+
silently dropped — the error pipeline fails precisely when a long/detailed message matters
|
|
130
|
+
most. Truncate any raw exception message / user string to the column width before `save()`
|
|
131
|
+
on any `_underscore` model write under strict mysqli.
|
|
116
132
|
|
|
117
133
|
## Change history
|
|
118
134
|
|
|
135
|
+
- 2026-07-15 — Added two framework gotchas from aligning the `_underscore` side of the
|
|
136
|
+
Issue/Event pipeline to the shared Core Logs DB: (1) cross-tenant secret exposure when
|
|
137
|
+
captured context lands in the shared DB, mitigated by `redactSensitiveContext()` in
|
|
138
|
+
Error.php; (2) strict-mysqli varchar overflow throwing inside the handler's `catch(Throwable)`
|
|
139
|
+
silently drops the Issue/Event row — truncate to column width before `save()`. (dfranks)
|
|
119
140
|
- 2026-07-08 — Corrected KB drift: documented the approved 2026-05-21 error-monitoring
|
|
120
141
|
architecture (handlers POST to a centralized `/errors` receiver; a worker2 cron builds
|
|
121
142
|
issueHash, upserts Issues + inserts Events into the Core Logs DB, aggregates/escalates,
|
package/package.json
CHANGED