PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Common PHP/Laravel Pitfalls: Understanding Array Slicing

hackerone.com | blog | #php | #secure-coding | #tutorial | #laravel | #array-slice | #coding-pitfalls
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A common PHP/Laravel pitfall: array_slice and Collection::slice take a length as the second argument, unlike end-index slicing in JavaScript and Python, causing subtle off-by-one bugs.
Published
Collected

Related coverage

blog · hackerone.com
PHP Date Handling: Subtle Pitfalls Subtracting Months
Carbon's subMonth() overflows on month-end dates—subtracting a month from December 31st lands on December 1st—so HackerOne recommends startOfMonth() or subMonthNoOverflow() to avoid the surprise.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · hackerone.com
Hardening Your Laravel Applications: Tips for Secure Session and Cookie Management
Laravel ships solid session and cookie management, but misconfiguration can still expose sessions. This guide walks through hardening encryption, expiration, and secure cookie settings.
blog · hackerone.com
Slow Rolling Refactors in Laravel: Ensuring a Smooth Transition
A HackerOne engineering post advocates gradual refactoring in Laravel: small reversible changes, starting with the slowest database queries, and automated PHPUnit and Dusk tests as a safety net.
blog · hackerone.com
The Top 5 Most Common Security Issues I Discover When Reviewing Code
A veteran code reviewer counts down the five security issues he finds most often, starting with PII and secrets leaking into logs and poor cryptography choices, with Python and Ruby examples.
blog · hackerone.com
5 Ways I Provide Value as a PullRequest Reviewer When I Start Reviewing a New Project
A PullRequest reviewer describes five ways to add immediate value on a new project, starting with catching security vulnerabilities that most updates introduce, often fixable with minor changes.
Back