-
Notifications
You must be signed in to change notification settings - Fork 0
feat: peek to pick one item without dequeing #1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -42,6 +42,12 @@ public function dequeue(): ?string | |||||
| return $data ?? null; | ||||||
| } | ||||||
|
|
||||||
| public function peek(): ?string | ||||||
| { | ||||||
| $data = $this->connection->querySingle("SELECT data FROM queue ORDER BY id ASC LIMIT 1"); | ||||||
| return $data ?: null; | ||||||
|
||||||
| return $data ?: null; | |
| return $data === null ? null : $data; |
Copilot
AI
Feb 23, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The SqliteStorage::exist method builds an SQL query by interpolating the untrusted $value directly into the string: "SELECT COUNT(*) FROM queue WHERE data = '$value'". If exist is ever called with attacker-controlled input, an attacker can inject arbitrary SQL (e.g. using a value like 'foo' OR 1=1 --) to read or manipulate data in the same SQLite database. Use parameterized queries with bound parameters (as done in enqueue) rather than string concatenation for the WHERE clause to prevent SQL injection.
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,168 @@ | ||||||
| <?php | ||||||
|
|
||||||
| use Slowmove\SimplePhpQueue\Storage\Adapters\FileStorage; | ||||||
| use Slowmove\SimplePhpQueue\Storage\Adapters\SqliteStorage; | ||||||
|
|
||||||
| // ─── FileStorage ───────────────────────────────────────────────────────────── | ||||||
|
|
||||||
| describe('FileStorage', function () { | ||||||
| beforeEach(function () { | ||||||
| $this->file = tempnam(sys_get_temp_dir(), 'queue_file_') . '.txt'; | ||||||
|
||||||
| $this->file = tempnam(sys_get_temp_dir(), 'queue_file_') . '.txt'; | |
| $this->file = tempnam(sys_get_temp_dir(), 'queue_file_'); |
Copilot
AI
Feb 23, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Same tempnam() issue as above: appending ".db" leaks the original temp file created by tempnam(). Prefer using the returned path directly or explicitly rename+cleanup so the test suite doesn't leave stray temp files.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
peek()usesuseTube()+peekReady(), butdequeue()useswatch($this->tube).peekReady()is not tube-scoped in the Beanstalk protocol, so this can return a job that this queue instance would never dequeue. Either implement peek in a tube-consistent way (e.g., watch+reserve+release with care) or document/rename this behavior as a global peek.