Skip to content

migration_report.md

Latest commit

 

History

History
181 lines (147 loc) · 6.34 KB

migration_report.md

File metadata and controls

181 lines (147 loc) · 6.34 KB
Raw

Migration Report: Kohana v3.3.6 to PHP 8.3

1. Executive Summary

The Kohana v3.3.6 framework has been successfully migrated to be compatible with PHP 8.3 and includes security patches for known vulnerabilities. All critical errors preventing the application from booting and executing tests have been resolved.

Final Test Results: 1321 tests, 2978 assertions, 0 errors, 0 failures, 2 skipped.

2. Key Achievements

Core Compatibility

  • Exception handling updated to accept Throwable
  • ArrayAccess signatures updated for PHP 8.3
  • Iterator/Countable interfaces fixed with #[ReturnTypeWillChange]
  • Deprecated functions removed (get_magic_quotes_gpc, each)
  • Curly brace syntax fixed in markdown files
  • Fixed session_cache_limiter(FALSE) to session_cache_limiter('') for PHP 8.3 strict types compatibility

PHPUnit 9/10 Compatibility

  • assertRegExp → assertMatchesRegularExpression
  • assertNotTag → assertDoesNotMatchRegularExpression
  • @expectedException → expectException()
  • ReflectionProperty fixes for PHP 8.x
  • Timezone name updates (deprecated IANA names)

Strict Types Implementation

  • FULL DEPLOYMENT: Added declare(strict_types=1) to ALL 491 files in system/ and modules/, as well as all application/ files.
  • Fixed type casting issues:
    • Profiler.php: base_convert() expects string, not int
    • File.php: str_pad() expects string, not int
    • str_pad.php: ceil() results cast to (int) for str_repeat()
    • Session/Native.php: fixed argument type for session_cache_limiter

Security Fixes

  • CVE-2019-8979: SQL Injection in order_by() - direction parameter validation
  • bcrypt: Added password hashing with Auth::hash_password()
  • Cookies: HTTP-only, SameSite attributes enabled by default
  • CSRF: hash_equals() for timing-safe comparisons
  • XSS: Fixed Security::strip_image_tags()
  • PHP Object Injection Protection: Hardened unserialize() calls across the core and modules:
    • Added allowed_classes => false to Session, Cache, ORM, and Config readers.
    • Modernized Kohana::cache() to support granular allowed_classes whitelist (implemented in Route::cache()).

Modernization (PHP 8.3+)

  • Constructor Property Promotion implemented in:
    • Database_Expression
    • Validation, Controller, Config_Group, Validation_Exception, Log_Syslog, Encrypt
    • Log_File, Config_File_Reader
  • Match expression in Text::random()
  • Extensive use of Typed Properties and Return Types (e.g. mixed for ArrayAccess/Iterator methods)

3. Security Vulnerabilities Fixed

CVE Severity Description Status
CVE-2019-8979 Critical (9.8) SQL Injection in order_by() FIXED
Session Security Medium Timing attacks on cookies FIXED
Password Storage Medium SHA1 → bcrypt FIXED
XSS Medium strip_image_tags bypass FIXED

4. Test Results

PHPUnit 9.6.34
Tests: 1321, Assertions: 2978, Errors: 0, Failures: 0, Skipped: 2

Skipped Tests

  • Tests requiring mcrypt extension (removed in PHP 8.0)
  • Tests requiring HTTP PECL extension

Risky Tests

  • UploadTest::provider_valid - no assertions

5. Files Modified

Core Classes (system/classes/Kohana/)

  • Arr.php, Config.php, Controller.php, Cookie.php, Date.php, Debug.php
  • Encrypt.php, Exception.php, Feed.php, Form.php, Fragment.php, HTML.php
  • I18n.php, Inflector.php, Log.php, Model.php, Num.php, Profiler.php
  • Request.php, Route.php, Security.php, Session.php, Text.php, Upload.php
  • URL.php, UTF8.php, Valid.php, Validation.php, View.php

Database Module

  • Kohana/Database/Expression.php - Constructor Property Promotion
  • Kohana/Database/Result.php - Iterator interfaces
  • Kohana/Database/MySQL/Result.php - MySQL result handling
  • Kohana/Database/MySQLi/Result.php - MySQLi result handling
  • Kohana/Database/Result/Cached.php - Cached results
  • Kohana/Database/Query/Builder.php - SQL Injection fix (CVE-2019-8979)

Auth Module

  • Kohana/Auth.php - bcrypt password hashing
  • Kohana/Auth/File.php - updated check_password
  • tests/kohana/AuthTest.php - new test suite (9 tests)

UTF8 Functions

  • system/utf8/str_pad.php - Type casting for mb_substr

Tests (system/tests/kohana/)

  • TextTest.php - PHPUnit 9/10 assertions
  • UTF8Test.php - strcasecmp comparison fix
  • DateTest.php - Timezone name updates
  • ConfigTest.php - Exception testing
  • HTTPTest.php - Apache headers requirement
  • Request_ClientTest.php - Reflection fix
  • EncryptTest.php - Simplified for PHP 8.x
  • URLTest.php - Syntax fix

6. Configuration Files Added

Cookie Configuration (application/config/cookie.php)

return array(
    'salt' => NULL,          // Set in production!
    'expiration' => 0,
    'path' => '/',
    'domain' => NULL,
    'secure' => FALSE,        // Set TRUE for HTTPS
    'httponly' => TRUE,       // SECURITY: Prevents XSS
    'samesite' => 'Lax',     // SECURITY: CSRF protection
);

Auth Configuration Updates

return array(
    // ... existing config ...
    'bcrypt_cost' => 12,      // SECURITY: Recommended cost factor
);

7. How to Run Tests

# Run all unit tests
./vendor/bin/phpunit

# Run specific test suite
./vendor/bin/phpunit --testsuite="Migration"
./vendor/bin/phpunit --testsuite="System"
./vendor/bin/phpunit --testsuite="Modules"

# Run specific test
./vendor/bin/phpunit --filter="test_response_failure_status"

8. Migration Notes for Developers

Password Hashes

Users with SHA256 hashes should be migrated to bcrypt:

// Check if user needs rehash
if ($auth->needs_rehash($user->password)) {
    $user->password = $auth->hash_password($plaintext);
    $user->save();
}

Cookie Configuration

Add to application/bootstrap.php:

Cookie::init();

Trusted Hosts

Configure in application/config/url.php:

'trusted_hosts' => array(
    'example\.org',
    'localhost',
),

9. Future Recommendations

  1. Complete Strict Types: Add to modules with dependency-ordered approach
  2. Readonly Properties: Use for immutable config objects
  3. Union Types: Replace PhPDoc annotations with native types
  4. Constructor Property Promotion: Continue refactoring classes
  5. ORM Tests: Create dedicated test suite for ORM module