Latest Releases

Version 1.14.0 c3e536

feat(security): add GraphQL validation and rate limiting v1.14.0

- Add validation: search >= 2 chars OR category required
- Add rate limiting via Magento Backpressure mechanism
- Add logging for suspicious query attempts
- Add admin configuration for rate limits
- Limit pageSize to 20 for short/empty search queries

BREAKING CHANGE: Empty or single-character search queries without category filter will now return GraphQlSecurityException c2b4ec

feat(security): add GraphQL validation and rate limiting v1.14.0

- Add validation: search >= 2 chars OR category required
- Add rate limiting via Magento Backpressure mechanism
- Add logging for suspicious query attempts
- Add admin configuration for rate limits
- Limit pageSize to 20 for short/empty search queries

BREAKING CHANGE: Empty or single-character search queries without category filter will now return GraphQlSecurityException 69d3fc

Version 1.12.26 74dff6

Improve the libxml fix to include `data-post` and `data-config` attrs 3fee5e

Version 1.1.36 a08cce

Fix validator consistency: reject empty strings and improve documentation

Changes:
- Empty string now returns false (more consistent behavior)
Previously: isValid('') returned true, expecting Router to handle it
Now: isValid('') returns false with error message "Identifier cannot be empty"
Router already checks !empty() before calling validator, so no behavior change

- Enhanced PHPDoc with real-world attack examples
Added Problem #1 and #2 references with actual scanner URLs:
* Basic SQL injection: /(select 198766*667891)/...
* Time-based blind SQLi: /DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||...)/...

Addresses code review feedback for better consistency and documentation. b6671d

Add input validation for FAQ/Category identifiers to prevent SQL injection attempts

Implemented IdentifierValidator to validate FAQ and Category identifiers from URLs before database lookup. This prevents false positive alerts in WAF/SIEM systems and reduces log spam from security scanners attempting SQL injection attacks.

Changes:
- Added Model/Validator/IdentifierValidator extending AbstractValidator
- Validates identifier format (a-z0-9-/) and length (max 100 chars)
- Blocks 25 SQL keywords including SELECT, UNION, SLEEP, DBMS_PIPE, CHR, etc.
- Integrated validator into Controller/Router for both getFaqIdentifier() and getFaqCategoryIdentifier()
- Returns 404 for invalid identifiers without DB query

Protects against:
- Basic SQL injection (SELECT, UNION, DROP, etc.)
- Time-based blind SQL injection (SLEEP, BENCHMARK, WAITFOR, DBMS_PIPE)
- String manipulation attacks (CHR, CHAR, CONCAT)

Note: System is not vulnerable to SQL injection due to PDO prepared statements. This is defense-in-depth to reduce false positives and log spam. a76a4e

Version 1.1.35 006c83

Fix HTML entity decoding order in FAQ schema cleaner

Decode HTML entities before stripping tags to prevent <script>
from becoming <script> after sanitization. Also add explicit script/style
removal and 5000 char limit per Google recommendations.

Fixes DOM breakage caused by encoded scripts in FAQ content. 8d443a

Version 1.12.26 74dff6

Improve the libxml fix to include `data-post` and `data-config` attrs 3fee5e