fix: bypass the presentation cache when the key digest cannot be encoded

The digest parts come raw off the query string, and percent-decoding hands
them over as bytes: expand=%FF arrives as "\xFF", which is not valid UTF-8,
so json_encode() returns false - and hash() coerces that false to "" without
a warning, the file not declaring strict_types. Every request carrying any
malformed byte then collapsed onto one digest per presentation, serializer
class included, undoing every discriminator dea76db added: an admin-shaped
payload cached under the constant digest was served verbatim to a public
caller whose own request also failed to encode.

The trigger needs a privileged caller to emit malformed UTF-8 inside the TTL,
which nothing in the platform does organically, so this is hardening rather
than a live hole - but the guard is one expression: the encode result is
captured, and a request whose parts cannot be keyed unambiguously skips the
cache entirely, read and write both. Serving fresh is preferred over
JSON_INVALID_UTF8_SUBSTITUTE, which would still merge requests differing only
in which invalid byte they carried.

Flagged by CodeRabbit on PR #577 (r3714097910), verified end to end in the
container: Illuminate\Http\Request::create preserves the raw byte through
input(), and hash('sha256', false) raises nothing at E_ALL.

Author: smarcet

app/ModelSerializers/Summit/Presentation/PresentationSerializer.php

@@ -266,26 +266,29 @@ public function serialize($expand = null, array $fields = [], array $relations =
         // last_edited stays readable so a presentation update naturally busts every entry it has
         // without an explicit Cache::forget, and so an operator can still scan or drop one
         // presentation's entries by pattern.
+        // The parts come raw off the query string, and percent-decoding hands them over as
+        // bytes: a malformed sequence like %FF makes json_encode() return false, which hash()
+        // would silently coerce to "" - collapsing class, expand, fields and relations onto one
+        // shared digest per presentation, the exact cross-audience collision the digest exists
+        // to prevent. A request that cannot be keyed unambiguously bypasses the cache entirely.
+        $digest_source = json_encode
+        ([
+            'serializer' => static::class,
+            'expand'     => $expand ?? "",
+            'fields'     => $cache_fields,
+            'relations'  => $cache_relations,
+        ]);
+
         $key =
             sprintf
             (
                 "presentation_%s_%s_%s",
                 $presentation->getId(),
                 $presentation->getLastEditedUTC()?->getTimestamp() ?? 0,
-                hash
-                (
-                    'sha256',
-                    json_encode
-                    ([
-                        'serializer' => static::class,
-                        'expand'     => $expand ?? "",
-                        'fields'     => $cache_fields,
-                        'relations'  => $cache_relations,
-                    ])
-                )
+                hash('sha256', (string) $digest_source)
             );
 
-        $use_cache = $params['use_cache'] ?? false;
+        $use_cache = ($params['use_cache'] ?? false) && $digest_source !== false;
 
         if($use_cache){
             // One read, not Cache::has() followed by Cache::get(): the entry can expire on its

tests/PresentationSerializerCacheKeyTest.php

@@ -184,4 +184,32 @@ public function testExpandOrderIsNotNormalised()
 
         $this->assertCount(2, $this->store);
     }
+
+    /**
+     * The digest parts come raw off the query string, and percent-decoding hands them over as
+     * bytes: expand=%FF arrives as "\xFF", which is not valid UTF-8, so json_encode() returns
+     * false - and hash() coerces that false to "" without a warning. Every request carrying any
+     * malformed byte then shares one digest per presentation, serializer class included, which
+     * is exactly the admin-payload-to-public-caller collision the class component exists to
+     * prevent. A request that cannot be keyed unambiguously must not touch the cache at all.
+     */
+    public function testMalformedUtf8RequestsDoNotCollideOnOneEntry()
+    {
+        $presentation = $this->buildPresentation(90205);
+        $context = $this->buildPublicContext();
+
+        $admin = (new AdminPresentationSerializer($presentation, $context))
+            ->serialize(null, ['id', 'rank', "\xFF"], [], ['use_cache' => true]);
+        // Sanity, mirroring testAdminPayloadIsNotServedToAPublicCaller: the admin payload
+        // really carries the field whose leak is asserted below.
+        $this->assertSame(7, $admin['rank']);
+
+        $public = (new PresentationSerializer($presentation, $context))
+            ->serialize(null, ['id', "\xFE"], [], ['use_cache' => true]);
+
+        // Before the guard both digests collapsed to hash("") and this came back with the
+        // admin-shaped payload, rank included.
+        $this->assertArrayNotHasKey('rank', $public);
+        $this->assertSame(90205, $public['id']);
+    }
 }