Vuln rc av#824
Merged
Merged
Conversation
Codecov Report❌ Patch coverage is ❌ Your patch check has failed because the patch coverage (18.46%) is below the target coverage (70.00%). You can increase the patch coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## dev #824 +/- ##
============================================
- Coverage 26.68% 26.56% -0.12%
- Complexity 5683 5744 +61
============================================
Files 270 277 +7
Lines 24258 24434 +176
============================================
+ Hits 6473 6491 +18
- Misses 17785 17943 +158 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces a new rate-limiting mechanism for WordPress “remote calls” to mitigate abuse, including a dedicated DB table, a WordPress-specific limiter implementation, and test coverage to validate the intended behavior.
Changes:
- Add a generic
Cleantalk\Common\RateLimiterlibrary (config/DTO/base logic) and WordPress adapterApbctRateLimiter. - Enforce remote-call rate limiting in
RemoteCalls::perform()and adjust cooldown timestamp updates to occur only after authorization. - Extend PHPUnit tests to cover the new rate-limit behavior and UID generation strategy (per-IP).
Reviewed changes
Copilot reviewed 22 out of 22 changed files in this pull request and generated 14 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/ApbctWP/TestRemoteCalls.php | Adds tests asserting the presence/placement of remote-call rate limiting and cooldown behavior. |
| tests/ApbctWP/RateLimit/TestApbctRateLimiter.php | Adds unit tests validating per-IP UID generation (UA ignored) using RateLimiter stubs. |
| psalm.xml | Updates Psalm ignore list to exclude new Common Templates/RateLimiter directories (and Singleton). |
| lib/Cleantalk/Common/Templates/Singleton.php | Introduces a Common Singleton trait (used by new Common code). |
| lib/Cleantalk/Common/Templates/Multiton.php | Introduces a Common Multiton trait built atop the Common Singleton trait. |
| lib/Cleantalk/Common/Templates/Dto.php | Introduces a Common DTO base class used by the RateLimiter DTO. |
| lib/Cleantalk/Common/Templates/composer.json | Adds Composer metadata/autoload for the Common Templates subpackage. |
| lib/Cleantalk/Common/Templates/.gitignore | Adds package-local gitignore for the Common Templates subpackage. |
| lib/Cleantalk/Common/Schema.php | Adds the rate_limits table schema definition. |
| lib/Cleantalk/Common/RateLimiter/tests/psalm.xml | Adds Psalm config for the RateLimiter subpackage tests. |
| lib/Cleantalk/Common/RateLimiter/tests/phpunit.xml | Adds PHPUnit config for the RateLimiter subpackage tests. |
| lib/Cleantalk/Common/RateLimiter/tests/.phpcs.xml | Adds PHPCS ruleset for the RateLimiter subpackage tests. |
| lib/Cleantalk/Common/RateLimiter/README.md | Adds RateLimiter subpackage README (currently placeholder). |
| lib/Cleantalk/Common/RateLimiter/RateLimiterDto.php | Adds DTO representing stored rate-limit records. |
| lib/Cleantalk/Common/RateLimiter/RateLimiterConfig.php | Adds config object for limiter type/limit/period. |
| lib/Cleantalk/Common/RateLimiter/RateLimiter.php | Adds abstract base rate-limiter logic and required persistence hooks. |
| lib/Cleantalk/Common/RateLimiter/composer.json | Adds Composer metadata/autoload for the RateLimiter subpackage. |
| lib/Cleantalk/Common/RateLimiter/.gitignore | Adds package-local gitignore for the RateLimiter subpackage. |
| lib/Cleantalk/ApbctWP/State.php | Defines APBCT_TBL_RATE_LIMITS constant for the new table. |
| lib/Cleantalk/ApbctWP/RemoteCalls.php | Adds pre-cooldown rate-limit enforcement and moves last_call updates after authorization. |
| lib/Cleantalk/ApbctWP/RateLimit/ApbctRateLimiter.php | Adds WP/DB-backed implementation of the rate limiter (per-IP UID). |
| composer.json | Adds cleantalk/rate-limiter to runtime requirements. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://app.doboard.com/1/task/50328