LiveView flash tokens verified 1000x too long

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

Phoenix.Token.verify/4 expected seconds, but the LiveView flash check passed :timer.seconds(60), so sessions stayed valid for 60000 seconds instead of 60.

38 commits 28 PRs merged 7 briefings covered

all elixir reviews →

← previous week elixir wire → next week →

Fix max flash age unit in Utils.verify_flash (#4429) phoenixframework/phoenix_live_view

by Barna Kovacs

Phoenix.Token.verify/4 expects max_age in seconds, but @max_flash_age was set with :timer.seconds(60), which evaluates to 60000. Flash token verification has therefore been accepting stale tokens for about 16 hours rather than the intended minute, an order-of-magnitude error that widens the window for replayed or stale flash data.

Fix `exists?` semantics for query combinations elixir-ecto/ecto

by lukaszsamson

exists? now preserves the original query form and wraps it in a subquery instead of rewriting set membership to SELECT 1, which produced invalid queries. The fix targets the combination cases tracked in the linked issue, so queries that mixed set membership with other filters no longer break.

Mix test parameters into the per-test :rand seed elixir-lang/elixir

by jechol

ExUnit seeds each test process with {phash2(module), phash2(name), suite_seed}; parameterize re-runs the module per parameter set while leaving test.name unchanged, so every parameterized run started from the same :rand state and drew the same random sequence. Test parameters are now mixed into the per-test seed.

Guard hook disconnected lifecycle callback phoenixframework/phoenix_live_view

by lukaszsamson

Each channel.onError during a persistent connection problem called hook.disconnected(), while the matching __reconnected() was guarded by __isDisconnected. The PR makes the behaviour symmetric, so hooks no longer see repeated disconnected callbacks without a corresponding reconnect.

Simplify push events diff (#4427) phoenixframework/phoenix_live_view

by Barna Kovacs

get_push_events_diff/1 now builds the events map directly. The getter returns a list, always truthy in Elixir, so the conditional it replaced had an unreachable falsy branch; the redundant check is gone.

Avoid mutating JS push options phoenixframework/phoenix_live_view

by lukaszsamson

The JS push() path mutated the caller's options object. A hook that reuses one opts object across two push() calls would misbehave; destructuring and spread now leave user data untouched.

Use :infinity as timeout when getting async pids phoenixframework/phoenix_live_view

by Steffen Deusch

Async PID lookup now uses :infinity, matching the default already used in the call helper, so it no longer times out under the previous default.

Remove redundant stream-rendering branches (#4433) phoenixframework/phoenix_live_view

by Barna Kovacs

A cleanup that removes redundant stream-rendering branches, alongside smaller fixes this period: Elixir's compiler now warns on unused and duplicated aliases, float round/2, floor/2 and ceil/2 raise the correct exception for invalid precision, and IEx no longer crashes on incomplete codepoint autocomplete.

$ ls elixir/week/ # the briefings behind this review

Mon Sep 7 LiveView flash age 1000x too long, plus IEx autocomplete crash fix Tue Sep 8 LiveView async fixes, Elixir docs gains Wed Sep 9 ExUnit parameterized tests now draw unique random sequences Thu Sep 10 LiveView preserves caret in more input types, Elixir changes type projection and guards Fri Sep 11 ExUnit restores async modules in reverse, OptionParser raises the wrong error Sat Sep 12 Faster Range.disjoint?, LiveUploader trims copies, Ecto filter/2 docs corrected Sun Sep 13 Elixir compiler warns on unused and duplicated aliases

all elixir reviews →

← previous week elixir wire → next week →