Update tests that were using invalid values for HopsStamp (0 is now
invalid, must be >= 1) and update expected output format for
mainScript (now uses json_encode which produces double quotes).
- Remove DOMContentLoaded listener after it fires to prevent memory leak
- Clean up timer interval and event listeners when notification is removed
- Add null check in stringToHTML to throw clear error for invalid templates
- Store cleanup function on notification element for proper disposal
Added tests for memory leak prevention and error handling.
HopsStamp:
- Validate hops amount must be >= 1 (positive integer)
- Negative or zero hops don't make logical sense
DelayStamp:
- Validate delay must be >= 0 (non-negative integer)
- Negative delays don't make logical sense
Both now throw InvalidArgumentException for invalid values, making
configuration errors fail fast with clear messages.
Previously, negative limits caused array_slice() to return unexpected
results (all except last N elements) and zero returned an empty array
without clear intent.
Now throws InvalidArgumentException for values < 1, making invalid
configurations fail fast with a clear error message.
Add validation to ensure services tagged with 'flasher.presenter' have
the required 'alias' attribute. Previously, accessing $attributes['alias']
without checking would throw an "Undefined array key" error.
Now throws a clear InvalidArgumentException with a helpful message.
The json_decode() with JSON_THROW_ON_ERROR throws an exception before
the ?: operator can provide a fallback value. This caused page crashes
when invalid JSON was passed to the Blade component attributes.
Now using a helper method with try-catch to safely decode JSON and
return an empty array on failure, preventing page crashes.
Laravel's event dispatcher expects listener classes to be invokable
(have __invoke method) when registered as a class name string.
The OctaneListener was using a handle() method which caused the
listener to never be invoked, resulting in notification state leaking
between Octane requests.
Renamed handle() to __invoke() to fix the issue.
The getPublicDir() method can return null, but the code was directly
concatenating it with a string, which could cause unexpected behavior.
Now the command properly checks for null and returns a failure with
a clear error message instead of proceeding with an invalid path.
The HtmlPresenter was interpolating user-controlled values directly into
HTML attributes and JavaScript code without proper escaping, creating
XSS vulnerabilities.
Changes:
- Escape nonce with htmlspecialchars() for HTML attribute context
- Escape nonce with json_encode() for JavaScript string context
- Escape mainScript with json_encode() for JavaScript string context
Added tests to verify XSS payloads are properly escaped.
The condition in registerLivewire() was inverted, causing the Livewire
listener to never be registered when Livewire was actually available.
Before: returned early when Livewire class exists AND is NOT bound
After: returns early when Livewire class does NOT exist OR is NOT bound
This fixes Livewire notifications not being displayed in Livewire components.
This commit updates the FlasherMiddleware and SessionMiddleware to utilize Symfony's base response class instead of Laravel's. This change ensures broader compatibility and addresses the issue with flash message rendering after page refreshes as identified by the community. Preparing for release in v2.0.2.
Younes ENNAJI