appsec/laravel: be more defensive

[cataphract]

Just doing isset($user['username']) is not safe is $user doesn't implement ArrayAccess.

php > class A {}
php > $a = new A;
php > var_dump(isset($a['x']));
PHP Warning: Uncaught Error: Cannot use object of type A as array in php shell code:1 Stack trace:
thrown in php shell code on line 1

Description

Reviewer checklist

• Test coverage seems ok.
• Appropriate labels assigned.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.61%. Comparing base (867b36c) to head (b49e000).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3503   +/-   ##
=======================================
  Coverage   61.61%   61.61%           
=======================================
  Files         142      142           
  Lines       12975    12975           
  Branches     1700     1700           
=======================================
  Hits         7995     7995           
- Misses       4218     4219    +1     
+ Partials      762      761    -1     

see 1 file with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 867b36c...b49e000. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pr-commenter]

Benchmarks [ appsec ]

Benchmark execution time: 2025-11-26 18:43:47

Comparing candidate commit 05af36e in PR branch glopes/appsec-laravel-fix with baseline commit 0c35caf in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics.

[pr-commenter]

Benchmarks [ tracer ]

Benchmark execution time: 2025-12-03 17:22:29

Comparing candidate commit b49e000 in PR branch glopes/appsec-laravel-fix with baseline commit 867b36c in branch master.

Found 4 performance improvements and 3 performance regressions! Performance is the same for 186 metrics, 1 unstable metrics.

scenario:ComposerTelemetryBench/benchTelemetryParsing

• 🟩 execution_time [-1346.608ns; -253.392ns] or [-12.132%; -2.283%]

scenario:MessagePackSerializationBench/benchMessagePackSerialization

• 🟩 execution_time [-6.457µs; -5.643µs] or [-6.030%; -5.270%]

scenario:MessagePackSerializationBench/benchMessagePackSerialization-opcache

• 🟩 execution_time [-3.946µs; -2.334µs] or [-3.494%; -2.067%]

scenario:PDOBench/benchPDOOverhead

• 🟥 execution_time [+4.763µs; +8.829µs] or [+2.157%; +3.998%]

scenario:PDOBench/benchPDOOverheadWithDBM

• 🟥 execution_time [+9.002µs; +11.960µs] or [+4.112%; +5.464%]

scenario:PHPRedisBench/benchRedisOverhead

• 🟥 execution_time [+34.275µs; +67.515µs] or [+4.024%; +7.926%]

scenario:TraceSerializationBench/benchSerializeTrace

• 🟩 execution_time [-45.363µs; -33.937µs] or [-9.924%; -7.424%]