Merge branch '5.x' into 5.next

# Conflicts:
#	src/Controller/ComposerController.php
#	src/ToolbarService.php
#	tests/TestCase/Mailer/Transport/DebugKitTransportTest.php

Author: LordSimal

.github/SECURITY.md

@@ -0,0 +1,25 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are applied to all active versions listed in the
+[version map](https://github.com/cakephp/debug_kit/wiki#version-map).
+Versions marked as EOL no longer receive fixes.
+
+## Reporting a Vulnerability
+
+If you've found a security issue in CakePHP DebugKit, please use the following
+procedure instead of the normal bug reporting system. Instead of using the bug
+tracker, or one of the support forums please send an email to
+security [at] cakephp.org. Emails sent to this address go to the CakePHP core
+team on a private mailing list.
+
+For each report, we try to first confirm the vulnerability. Once confirmed,
+the CakePHP team will take the following actions:
+
+* Acknowledge to the reporter that we've received the issue, and are
+  working on a fix. We ask that the reporter keep the issue confidential until we announce it.
+* Get a fix/patch prepared.
+* Prepare a post describing the vulnerability, and the possible exploits.
+* Release new versions of all affected versions.
+* Prominently feature the problem in the release announcement

.phive/phars.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <phive xmlns="https://phar.io/phive">
-  <phar name="phpstan" version="2.1.31" installed="2.1.31" location="./tools/phpstan" copy="false"/>
-  <phar name="psalm" version="7.0.0-beta16" installed="7.0.0-beta16" location="./tools/psalm" copy="false"/>
+  <phar name="phpstan" version="2.1.55" installed="2.1.55" location="./tools/phpstan" copy="false"/>
+  <phar name="psalm" version="7.0.0-beta19" installed="7.0.0-beta19" location="./tools/psalm" copy="false"/>
 </phive>

phpstan-baseline.neon

@@ -1,11 +1,5 @@
 parameters:
 	ignoreErrors:
-		-
-			message: '#^Method DebugKit\\Mailer\\Transport\\DebugKitTransport\:\:send\(\) should return array\{headers\: string, message\: string\} but returns array\{headers\: non\-empty\-array\<string, string\>, message\: array\{text\: string, html\: string\}\}\.$#'
-			identifier: return.type
-			count: 1
-			path: src/Mailer/Transport/DebugKitTransport.php
-
 		-
 			message: '#^Parameter \#1 \$request of method DebugKit\\ToolbarService\:\:saveData\(\) expects Cake\\Http\\ServerRequest, Psr\\Http\\Message\\ServerRequestInterface given\.$#'
 			identifier: argument.type

psalm-baseline.xml

@@ -11,9 +11,6 @@
     </ImpureMethodCall>
   </file>
   <file src="src/Mailer/Transport/DebugKitTransport.php">
-    <InvalidReturnStatement>
-      <code><![CDATA[$result]]></code>
-    </InvalidReturnStatement>
     <NullArgument>
       <code><![CDATA[$this->emailLog]]></code>
     </NullArgument>

src/Controller/ComposerController.php

@@ -53,22 +53,24 @@ public function checkDependencies(): void
 
         $output = $this->executeComposerCommand($input);
         $dependencies = array_filter(explode("\n", $output->fetch()));
-        $packages = [];
+        $semverCompatible = [];
+        $bcBreaks = [];
         foreach ($dependencies as $dependency) {
             if (str_contains($dependency, 'php_network_getaddresses')) {
                 throw new RuntimeException('You have to be connected to the internet');
             }
             if (str_contains($dependency, '<highlight>')) {
-                $packages['semverCompatible'][] = $dependency;
+                $semverCompatible[] = $dependency;
                 continue;
             }
-            $packages['bcBreaks'][] = $dependency;
+            $bcBreaks[] = $dependency;
         }
-        if (!empty($packages['semverCompatible'])) {
-            $packages['semverCompatible'] = trim(implode("\n", $packages['semverCompatible']));
+        $packages = [];
+        if ($semverCompatible) {
+            $packages['semverCompatible'] = trim(implode("\n", $semverCompatible));
         }
-        if (!empty($packages['bcBreaks'])) {
-            $packages['bcBreaks'] = trim(implode("\n", $packages['bcBreaks']));
+        if ($bcBreaks) {
+            $packages['bcBreaks'] = trim(implode("\n", $bcBreaks));
         }
 
         $this->viewBuilder()->setOption('serialize', ['packages']);

src/Controller/ToolbarController.php

@@ -46,6 +46,9 @@ public function clearCache(): void
         if (!$name) {
             throw new NotFoundException('Invalid cache engine name.');
         }
+        if (!Cache::getConfig($name)) {
+            throw new NotFoundException(sprintf('Unknown cache engine "%s".', $name));
+        }
         $success = Cache::clear($name);
         $message = $success ?
             sprintf('%s cache cleared.', $name) :

src/Mailer/Transport/DebugKitTransport.php

@@ -7,6 +7,7 @@
 use Cake\Core\App;
 use Cake\Mailer\AbstractTransport;
 use Cake\Mailer\Message;
+use InvalidArgumentException;
 
 /**
  * Debug Transport class, useful for emulating the email sending process and inspecting
@@ -33,6 +34,11 @@ class DebugKitTransport extends AbstractTransport
      */
     public function __construct(array $config = [], ?AbstractTransport $originalTransport = null)
     {
+        if (!isset($config['debugKitLog']) || !$config['debugKitLog'] instanceof ArrayObject) {
+            throw new InvalidArgumentException(
+                'DebugKitTransport requires a `debugKitLog` config entry of type `ArrayObject`.',
+            );
+        }
         $this->emailLog = $config['debugKitLog'];
 
         if ($originalTransport instanceof AbstractTransport) {
@@ -58,7 +64,17 @@ public function __construct(array $config = [], ?AbstractTransport $originalTran
     }
 
     /**
-     * @inheritDoc
+     * Capture the message into the in-memory email log and optionally forward
+     * to a wrapped real transport.
+     *
+     * Overrides the parent return shape: DebugKit stores the headers as an
+     * associative array (so the panel can render rows) and splits the body
+     * into text/html parts. Callers that consume this transport's return
+     * value directly must account for this richer shape.
+     *
+     * @param \Cake\Mailer\Message $message The message to capture.
+     * @return array
+     * @phpstan-return array{headers: array<string, string>, message: array{text: string, html: string}}|array<string, mixed>
      */
     public function send(Message $message): array
     {

src/Panel/RequestPanel.php

@@ -54,7 +54,7 @@ public function shutdown(EventInterface $event): void
             'query' => Debugger::exportVarAsNodes($request->getQueryParams(), $maxDepth),
             'data' => Debugger::exportVarAsNodes($request->getData(), $maxDepth),
             'cookie' => Debugger::exportVarAsNodes($request->getCookieParams(), $maxDepth),
-            'get' => Debugger::exportVarAsNodes($_GET, $maxDepth),
+            'get' => Debugger::exportVarAsNodes($request->getQueryParams(), $maxDepth),
             'session' => Debugger::exportVarAsNodes($request->getSession()->read(), $maxDepth),
             'matchedRoute' => $request->getParam('_matchedRoute'),
             'headers' => [

src/ToolbarService.php

@@ -286,33 +286,40 @@ public function saveData(ServerRequest $request, ResponseInterface $response): R
 
         foreach ($this->registry->loaded() as $name) {
             $panel = $this->registry->{$name};
+            $data = null;
+            $handlerInstalled = false;
             try {
                 $data = $panel->data();
 
-                // Set error handler to catch warnings/errors during serialization
-                set_error_handler(function ($errno, $errstr) use ($name): void {
-                    throw new Exception(sprintf("Serialization error in panel '%s': %s", $name, $errstr));
-                });
+                // Catch only warnings/notices raised during serialization; fatals
+                // and exceptions in __sleep/__serialize already surface as throws.
+                set_error_handler(
+                    function ($errno, $errstr) use ($name): bool {
+                        throw new Exception("Serialization error in panel '{$name}': {$errstr}");
+                    },
+                    E_WARNING | E_NOTICE | E_USER_WARNING | E_USER_NOTICE,
+                );
+                $handlerInstalled = true;
 
                 $content = serialize($data);
-
-                restore_error_handler();
             } catch (Exception $e) {
-                restore_error_handler();
-
                 $errorMessage = sprintf(
                     'Failed to serialize data for panel "%s": %s',
                     $name,
                     $e->getMessage(),
                 );
 
                 Log::warning($errorMessage);
-                Log::debug('Panel data type: ' . gettype($data ?? null));
+                Log::debug('Panel data type: ' . gettype($data));
 
                 $content = serialize([
                     'error' => $errorMessage,
                     'panel' => $name,
                 ]);
+            } finally {
+                if ($handlerInstalled) {
+                    restore_error_handler();
+                }
             }
             $row->panels[] = $requests->Panels->newEntity([
                 'panel' => $name,

src/View/Helper/CredentialsHelper.php

@@ -57,7 +57,7 @@ public function filter(mixed $in): mixed
         $link = $this->Html->tag('a', '******', [
             'class' => 'filtered-credentials',
             'title' => h($credentials),
-            'onclick' => 'this.innerHTML = this.title',
+            'onclick' => 'this.textContent = this.title',
         ]);
 
         return h($protocol) . $link . '@' . h($tail);