FOUR-32464: [Octane] CRITICAL Data Leaks Between Requests, MEDIUM — Accumulating State

ProcessMaker/Http/Middleware/ServerTimingMiddleware.php

@@ -9,18 +9,10 @@
 
 class ServerTimingMiddleware
 {
-    // Minimum time in ms to include a package in the Server-Timing header
-    private static $minPackageTime;
-
-    public function __construct()
-    {
-        self::$minPackageTime = config('app.server_timing.min_package_time');
-    }
-
     /**
      * Handle an incoming request.
      *
-     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     * @param  Closure(Request): (Response)  $next
      */
     public function handle(Request $request, Closure $next): Response
     {
@@ -56,12 +48,13 @@ public function handle(Request $request, Closure $next): Response
         }
 
         $packageTimes = ProcessMakerServiceProvider::getPackageBootTiming();
+        $minPackageTime = config('app.server_timing.min_package_time');
 
         foreach ($packageTimes as $package => $timing) {
             $time = ($timing['end'] - $timing['start']) * 1000;
 
             // Only include packages that took more than MIN_PACKAGE_TIME ms
-            if ($time > self::$minPackageTime) {
+            if ($time > $minPackageTime) {
                 $serverTiming[] = "{$package};dur={$time}";
             }
         }

ProcessMaker/Jobs/BpmnAction.php

@@ -14,10 +14,10 @@
 use Illuminate\Support\Facades\Log;
 use ProcessMaker\BpmnEngine;
 use ProcessMaker\Exception\HttpABTestingException;
-use ProcessMaker\Listeners\HandleRedirectListener;
 use ProcessMaker\Models\Process as Definitions;
 use ProcessMaker\Models\ProcessRequest;
 use ProcessMaker\Models\ProcessRequestLock;
+use ProcessMaker\Services\RedirectToEventService;
 use Throwable;
 
 abstract class BpmnAction implements ShouldQueue
@@ -60,6 +60,7 @@ abstract class BpmnAction implements ShouldQueue
     public function handle()
     {
         $response = null;
+        $redirectToEventService = app(RedirectToEventService::class);
         try {
             extract($this->loadContext());
             $this->engine = $engine;
@@ -74,7 +75,7 @@ public function handle()
             // (e.g. completed, assigned, process completed, etc)
             // excluding system process (non_persistent_process)
             if ($this->processId !== 'non_persistent_process') {
-                HandleRedirectListener::sendRedirectToEvent();
+                $redirectToEventService->sendRedirectToEvent();
             }
         } catch (HttpABTestingException $exception) {
             Log::error($exception->getMessage());
@@ -87,6 +88,7 @@ public function handle()
                 $request->logError($exception, $element);
             }
         } finally {
+            $redirectToEventService->reset();
             $this->unlock();
         }
 

ProcessMaker/Listeners/HandleRedirectListener.php

@@ -2,51 +2,19 @@
 
 namespace ProcessMaker\Listeners;
 
-use ProcessMaker\Events\RedirectToEvent;
 use ProcessMaker\Models\ProcessRequest;
+use ProcessMaker\Services\RedirectToEventService;
 
 class HandleRedirectListener
 {
-    private static $processRequest = null;
-
-    protected static $redirectionMethod = '';
-
-    private static $redirectionParams = [];
-
-    protected function setRedirectTo(ProcessRequest $processRequest, string $method, ...$params): void
-    {
-        self::$processRequest = $processRequest;
-        self::$redirectionMethod = $method;
-        self::$redirectionParams = $params;
+    public function __construct(
+        private ?RedirectToEventService $redirectToEventService = null
+    ) {
     }
 
-    /**
-     * Reset the static state for Octane compatibility.
-     * This prevents data leaks between requests in long-running workers.
-     */
-    public static function reset(): void
-    {
-        self::$processRequest = null;
-        self::$redirectionMethod = '';
-        self::$redirectionParams = [];
-    }
-
-    public static function sendRedirectToEvent()
+    protected function setRedirectTo(ProcessRequest $processRequest, string $method, ...$params): void
     {
-        $method = self::$redirectionMethod;
-        $params = self::$redirectionParams;
-        $processRequest = self::$processRequest;
-
-        // Only get active tokens if there is a valid process request
-        if ($processRequest !== null) {
-            $params['activeTokens'] = ProcessRequest::getActiveTokens($processRequest);
-            $event = new RedirectToEvent($processRequest, $method, $params);
-            event($event);
-
-            // Clean params to prevent sending the same redirect multiple times
-            self::$redirectionParams = [];
-            self::$redirectionMethod = '';
-            self::$processRequest = null;
-        }
+        $this->redirectToEventService ??= app(RedirectToEventService::class);
+        $this->redirectToEventService->setRedirectTo($processRequest, $method, ...$params);
     }
 }

ProcessMaker/Managers/ControllerAddonsRegistry.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace ProcessMaker\Managers;
+
+class ControllerAddonsRegistry
+{
+    private $addons = [];
+
+    /**
+     * Register a controller addon.
+     */
+    public function register(string $scope, array $config): void
+    {
+        $config['scope'] = $scope;
+        $this->addons[] = $config;
+    }
+
+    /**
+     * Get configured addons for a controller.
+     */
+    public function getAddons(string $scope, string $method, array $data): array
+    {
+        $addons = [];
+
+        foreach ($this->addons as $addon) {
+            if ($addon['method'] !== $method || $addon['scope'] !== $scope) {
+                continue;
+            }
+
+            if (isset($addon['data']) && is_callable($addon['data'])) {
+                $data = call_user_func($addon['data'], $data);
+            }
+
+            $addon['content'] = isset($addon['view']) && !isset($addon['content'])
+                ? view($addon['view'], $data)->render()
+                : (isset($addon['content']) ? $addon['content'] : '');
+            $addon['script'] = isset($addon['script']) && is_string($addon['script'])
+                ? view($addon['script'], $data)->render()
+                : '';
+            $addons[] = $addon;
+        }
+
+        return $addons;
+    }
+}

ProcessMaker/Models/AnonymousUser.php

@@ -12,6 +12,12 @@ class AnonymousUser extends User
 
     protected $table = 'users';
 
+    public static function resolve(): self
+    {
+        return static::where('username', '=', static::ANONYMOUS_USERNAME)
+            ->firstOrFail();
+    }
+
     public $isAnonymous = true;
 
     public function receivesBroadcastNotificationsOn($notification)

ProcessMaker/Multitenancy/SwitchTenant.php

@@ -6,6 +6,7 @@
 use Illuminate\Contracts\Routing\UrlGenerator;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Env;
+use Illuminate\Support\Facades\Context;
 use Monolog\Handler\RotatingFileHandler;
 use ProcessMaker\Application;
 use ProcessMaker\Multitenancy\Broadcasting\TenantAwareBroadcastManager;
@@ -17,7 +18,7 @@ class SwitchTenant implements SwitchTenantTask
 {
     use UsesMultitenancyConfig;
 
-    public static $landlordValues = null;
+    private const LANDLORD_VALUES_CONTEXT_KEY = 'multitenancy.landlord_values';
 
     /**
      * Make the given tenant current.
@@ -31,9 +32,8 @@ public function makeCurrent(IsTenant $tenant): void
 
         \Log::debug('SwitchTenant: ' . $tenant->id, ['domain' => request()->getHost()]);
 
-        // Save the landlord values for later use
-        if (!self::$landlordValues) {
-            self::$landlordValues = $app->make('config')->all();
+        if (!Context::has(self::LANDLORD_VALUES_CONTEXT_KEY)) {
+            Context::add(self::LANDLORD_VALUES_CONTEXT_KEY, $app->make('config')->all());
         }
 
         // Set the tenant's domain in the request headers. Used for things like the global url() helper.
@@ -70,7 +70,7 @@ public function forgetCurrent(): void
 
     private function landlordConfig($key)
     {
-        return Arr::get(self::$landlordValues, $key);
+        return Arr::get(Context::get(self::LANDLORD_VALUES_CONTEXT_KEY), $key);
     }
 
     private function setConfig($key, $value)

ProcessMaker/Nayra/Repositories/EntityRepository.php

@@ -11,7 +11,7 @@
 
 abstract class EntityRepository
 {
-    private static $uid2id = ['requests' =>[], 'tokens' =>[]];
+    private $uid2id = ['requests' =>[], 'tokens' =>[]];
 
     abstract public function create(array $transaction): ? Model;
 
@@ -41,16 +41,16 @@ public function resolveId(string $uid): int
         }
 
         // Get record if is not stored previously
-        if (!isset(self::$uid2id[$type][$uid])) {
+        if (!isset($this->uid2id[$type][$uid])) {
             $record = $instance->select('id')->where('uuid', $uid)->first();
             if ($record) {
-                self::$uid2id[$type][$uid] = $record->getKey();
+                $this->uid2id[$type][$uid] = $record->getKey();
             } else {
                 throw new Exception("The uid {$uid} does not exist in the database");
             }
         }
 
-        return self::$uid2id[$type][$uid] ?? 0;
+        return $this->uid2id[$type][$uid] ?? 0;
     }
 
     /**
@@ -71,6 +71,6 @@ public function storeUid(string $uid, int $id): void
                 break;
         }
 
-        self::$uid2id[$type][$uid] = $id;
+        $this->uid2id[$type][$uid] = $id;
     }
 }

ProcessMaker/Observers/SettingObserver.php

@@ -10,7 +10,7 @@
 
 class SettingObserver
 {
-    private static $added_refresh_artisan_caches = false;
+    private bool $addedRefreshArtisanCaches = false;
 
     /**
      * Handle the setting "created" event.
@@ -95,7 +95,7 @@ private function invalidateSettingCache(Setting $setting)
 
         // Check to see if we already added the refresh to the app's terminating queue.
         // This is important for install commands when multiple settings are being created/updated.
-        if (self::$added_refresh_artisan_caches) {
+        if ($this->addedRefreshArtisanCaches) {
             return;
         }
 
@@ -106,6 +106,6 @@ private function invalidateSettingCache(Setting $setting)
             RefreshArtisanCaches::dispatchSync();
         });
 
-        self::$added_refresh_artisan_caches = true;
+        $this->addedRefreshArtisanCaches = true;
     }
 }

ProcessMaker/Octane/ResetRequestState.php

@@ -4,14 +4,19 @@
 
 namespace ProcessMaker\Octane;
 
-use ProcessMaker\Listeners\HandleRedirectListener;
 use ProcessMaker\Providers\ProcessMakerServiceProvider;
+use ProcessMaker\Services\RedirectToEventService;
 
 final class ResetRequestState
 {
+    public function __construct(
+        private readonly RedirectToEventService $redirectToEventService
+    ) {
+    }
+
     public function handle(): void
     {
         ProcessMakerServiceProvider::beginRequestTiming();
-        HandleRedirectListener::reset();
+        $this->redirectToEventService->reset();
     }
 }

ProcessMaker/Providers/ProcessMakerServiceProvider.php

@@ -56,6 +56,7 @@
 use ProcessMaker\Providers\PermissionServiceProvider;
 use ProcessMaker\Repositories\SettingsConfigRepository;
 use ProcessMaker\Services\ConditionalRedirectService;
+use ProcessMaker\Services\RedirectToEventService;
 use RuntimeException;
 use Spatie\Multitenancy\Events\MadeTenantCurrentEvent;
 use Spatie\Multitenancy\Events\TenantNotFoundForRequestEvent;
@@ -78,9 +79,6 @@ class ProcessMakerServiceProvider extends ServiceProvider
     // Track the query time for each request
     private static $queryTime = 0;
 
-    // Track the landlord values for multitenancy
-    private static $landlordValues = null;
-
     public function boot(): void
     {
         // Track the start time for service providers boot
@@ -136,6 +134,10 @@ public function register(): void
             return new Managers\LoginManager();
         });
 
+        $this->app->singleton(Managers\ControllerAddonsRegistry::class, function () {
+            return new Managers\ControllerAddonsRegistry();
+        });
+
         /*
          * Maps our Index Manager as a singleton. The Index Manager is used
          * to manage customizations to the search indexer.
@@ -194,11 +196,12 @@ public function register(): void
             return new Managers\GlobalScriptsManager();
         });
 
-        $this->app->singleton(Models\AnonymousUser::class, function ($app) {
-            return Models\AnonymousUser::where('username', '=', Models\AnonymousUser::ANONYMOUS_USERNAME)
-                                       ->firstOrFail();
+        $this->app->scoped(Models\AnonymousUser::class, function ($app) {
+            return Models\AnonymousUser::resolve();
         });
 
+        $this->app->scoped(Observers\SettingObserver::class);
+
         $this->app->singleton(PolicyExtension::class, function ($app) {
             return new PolicyExtension();
         });
@@ -249,6 +252,8 @@ public function register(): void
 
         $this->app->instance('tenant-resolved', false);
 
+        $this->app->scoped(RedirectToEventService::class);
+
         /**
          * Conditional Redirect Service
          * This service is used to evaluate the conditional redirect property of a process request token.