Regression Tests for the Laravel TokenGuard Patch Keep the Authentication Bypass Closed

·1 views

The article explains how to write regression tests that ensure the CVE-2026-114509 fix in Laravel's TokenGuard remains in place after deployment. The vulnerability involves non-string JSON credentials reaching the user lookup on MySQL, and the patched guard now rejects such values with an is_string() check before querying the provider. The recommended approach combines unit tests with a synthetic provider, integration tests on MySQL or MariaDB, and HTTP-level tests on a disposable application. It also calls for a version matrix covering the patched releases, pinned dependencies, and a non-affected database as a control. Together these layers guard against regressions from vendor changes, copied custom guards, or dependency updates.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Rivet launches open-source actor orchestrator for scaling AI agents with S3-backed storage

Rivet, a Y Combinator F25 startup, has launched an orchestrator that runs AI agents as lightweight actors instead of heavyweight sandboxes. Each actor offers long-lived processes, in-memory state, WebSocket support, and durable SQLite storage, and it hibernates when idle. The company says its actors use far less memory and start much faster than sandboxes, and the platform is open source and self-hostable. Rivet stores data primarily on S3, using an SSD tier to keep write and read speeds high while cutting costs. The company cites a customer, Amp, that migrated its multiplayer agents to Rivet after running into limits on Cloudflare Durable Objects.

0 comments Read more at Hacker News

ProgrammingHacker News ·

Bild AI, a YC W25 Startup, Is Hiring Founding Product Engineers

Bild AI, a company from the Y Combinator W25 batch, has posted job openings for founding product engineers. The listings are published on the company's page on Y Combinator's website. The source material provides little beyond the job announcement itself, so details about responsibilities, compensation, or location are not available. The post was shared on Hacker News, where it had not yet received any points or comments at the time it was captured.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

VRヘッドセットを視覚トレーニングに活用する設計: Amblyotubeの事例

EXOSHOCKのようなVRゲームの普及で、ヘッドセットを日常的に装着する習慣が広がりつつある。この流れを受けて、両眼に独立した映像を出せるVR機器を視覚トレーニングに応用する発想が生まれている。Seven SportsのAmblyotubeは、Meta Quest向けにYouTubeの映像を左右の目で別々に処理し、弱視や両眼協調の改善を目指す。アイパッチに比べて継続しやすく、仮想空間で視力測定の条件を一定に保てる点が特徴とされる。記事は、こうした設計判断をエンジニア視点で整理している。

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI agents still fail every GoCaptcha trial in a 209-attempt benchmark

An AI agent operating a benchmark program tested open-weight models against self-hosted CAPTCHAs in a scripted browser. Proof-of-work challenges from ALTCHA and Cap were solved in every trial, typically within seconds and at a cost of a fraction of a cent. GoCaptcha's image-based click challenge, however, produced zero solves across 209 attempts with three models. The authors attribute the failures to the agents running out of their attempt budgets, with the 95% upper confidence bound for success placed at about 1.8%. The article also reports that the program's own published posts have received essentially no reactions.

0 comments Read more at DEV Community