Repository navigation

Build/Test Tools: Check invariants while the PHPUnit suite runs. - #15480

Draft

dmsnell wants to merge 26 commits into

WordPress:trunkfrom

dmsnell:testing/add-gameshark

Draft

Build/Test Tools: Check invariants while the PHPUnit suite runs.#15480
dmsnell wants to merge 26 commits into
WordPress:trunkfrom
dmsnell:testing/add-gameshark

Commits on Nov 4, 2026
- Build/Test Tools: Check invariants while the PHPUnit suite runs.
  
  dmsnell
  and
  claude
  committed
  cd81222
Commits on Nov 5, 2026
- Build/Test Tools: Add twenty invariants, checked against independent parsers.
  
  dmsnell
  and
  claude
  committed
  89dafe4
- Build/Test Tools: Report how far the invariant run has got.
  
  dmsnell
  and
  claude
  committed
  ae1476a
- Build/Test Tools: Self-test that hooks see every argument of variadic functions.
  
  dmsnell
  and
  claude
  committed
  c15ef3b
- Build/Test Tools: Pin the invariant extension to a build which passes every argument.
  
  dmsnell
  and
  claude
  committed
  8deef29
- Build/Test Tools: Tell a prepared query from another query which shares its text.
  
  dmsnell
  and
  claude
  committed
  98aa2a8
- Build/Test Tools: Add invariant helpers for hidden state, sources and browser reads.
  
  dmsnell
  and
  claude
  committed
  d384ef4
- Build/Test Tools: Add the next twenty invariants, many checked against a browser.
  
  dmsnell
  and
  claude
  committed
  8693531
- Build/Test Tools: Add an invariant oracle which finds HTML syntax with the HTML API.
  
  dmsnell
  and
  claude
  committed
  07874da
- Build/Test Tools: Add invariants against escaped kses input, new markup, regex HTML parsing and path traversal.
  
  dmsnell
  and
  claude
  committed
  8795227
- Build/Test Tools: Pin the invariant extension to a build with catch-all hooks.
  
  dmsnell
  and
  claude
  committed
  e2a922d
- Build/Test Tools: Report the types every WordPress function is given and returns.
  
  dmsnell
  and
  claude
  committed
  7e075b0
- Build/Test Tools: Pin the invariant extension to a build which no longer corrupts the heap, and give PHP all the memory.
  
  dmsnell
  and
  claude
  committed
  61887f6
- Build/Test Tools: Note how invariants hook calls through __call() and generators.
  
  dmsnell
  and
  claude
  committed
  236aeb5
- Build/Test Tools: Report ints as literals in the types report until five distinct ones are seen.
  
  dmsnell
  and
  claude
  committed
  0d969eb
Commits on Nov 6, 2026
Commits on Nov 7, 2026
- Build/Test Tools: Leave known regex HTML parsers and user-typed escaped markup out of two invariants.
  
  dmsnell
  and
  claude
  committed
  42cd2f3

Navigation Menu

Repository navigation

Build/Test Tools: Check invariants while the PHPUnit suite runs. - #15480

Build/Test Tools: Check invariants while the PHPUnit suite runs.#15480
dmsnell wants to merge 26 commits into
WordPress:trunkfrom
dmsnell:testing/add-gameshark

Commits on Nov 4, 2026

Build/Test Tools: Check invariants while the PHPUnit suite runs.

Commits on Nov 5, 2026

Build/Test Tools: Add twenty invariants, checked against independent parsers.

Build/Test Tools: Report how far the invariant run has got.

Build/Test Tools: Self-test that hooks see every argument of variadic functions.

Build/Test Tools: Pin the invariant extension to a build which passes every argument.

Build/Test Tools: Tell a prepared query from another query which shares its text.

Build/Test Tools: Add invariant helpers for hidden state, sources and browser reads.

Build/Test Tools: Add the next twenty invariants, many checked against a browser.

Build/Test Tools: Add an invariant oracle which finds HTML syntax with the HTML API.

Build/Test Tools: Add invariants against escaped kses input, new markup, regex HTML parsing and path traversal.

Build/Test Tools: Pin the invariant extension to a build with catch-all hooks.

Build/Test Tools: Report the types every WordPress function is given and returns.

Build/Test Tools: Pin the invariant extension to a build which no longer corrupts the heap, and give PHP all the memory.

Build/Test Tools: Note how invariants hook calls through __call() and generators.

Build/Test Tools: Report ints as literals in the types report until five distinct ones are seen.

Commits on Nov 6, 2026

Build/Test Tools: Count the ints and strings in the types report by their properties.

Build/Test Tools: Add what the security invariants share: request values, scopes of calls, paths and attacker-shaped values.

Build/Test Tools: Add invariants which follow request values into HTML, SQL, unserialize() and email.

Build/Test Tools: Add invariants that request handlers check a nonce and a capability before they change anything.

Build/Test Tools: Add invariants against executable uploads and archive entries written outside their destination.

Build/Test Tools: Add invariants that secrets are never sent, and are made with a secure random number generator.

Build/Test Tools: Add an invariant that HTML stored while kses filters a field is already safe.

Build/Test Tools: Add invariants against SSRF, sanitizers which change their own output, and sites left switched.

Build/Test Tools: Add canaries which break each security invariant on purpose, and run them and the AJAX tests in CI.

Build/Test Tools: Tell numeric strings apart in the types report.

Commits on Nov 7, 2026

Build/Test Tools: Leave known regex HTML parsers and user-typed escaped markup out of two invariants.