disallow non-strings in semver comparisons (#98)

Author: eli-darkly

src/LaunchDarkly/Impl/Model/Operators.php

@@ -101,23 +101,33 @@ public static function apply(?string $op, $u, $c): bool
                     }
                     break;
                 case "semVerEqual":
-                    $uVer = self::parseSemVer($u);
-                    $cVer = self::parseSemVer($c);
-                    return ($uVer != null) && ($cVer != null) && $uVer->comparePrecedence($cVer) == 0;
+                    return self::semver_operator($u, $c, 0);
                 case "semVerLessThan":
-                    $uVer = self::parseSemVer($u);
-                    $cVer = self::parseSemVer($c);
-                    return ($uVer != null) && ($cVer != null) && $uVer->comparePrecedence($cVer) < 0;
+                    return self::semver_operator($u, $c, -1);
                 case "semVerGreaterThan":
-                    $uVer = self::parseSemVer($u);
-                    $cVer = self::parseSemVer($c);
-                    return ($uVer != null) && ($cVer != null) && $uVer->comparePrecedence($cVer) > 0;
+                    return self::semver_operator($u, $c, 1);
             }
         } catch (Exception $ignored) {
         }
         return false;
     }
 
+    /**
+     * @param mixed|null $u
+     * @param mixed|null $c
+     * @param int $expectedComparisonResult
+     * @return bool
+     */
+    private static function semver_operator($u, $c, $expectedComparisonResult): bool
+    {
+        if (!is_string($u) || !is_string($c)) {
+            return false;
+        }
+        $uVer = self::parseSemVer($u);
+        $cVer = self::parseSemVer($c);
+        return ($uVer != null) && ($cVer != null) && $uVer->comparePrecedence($cVer) == $expectedComparisonResult;
+    }
+
     /**
      * A stricter version of the built-in is_numeric checker.
      *

tests/Impl/Model/OperatorsTest.php

@@ -73,6 +73,11 @@ public function testSemVer()
         $this->assertTrue(Operators::apply("semVerGreaterThan", "2.0.0-rc.1", "2.0.0-rc.0"));
         $this->assertFalse(Operators::apply("semVerLessThan", "2.0.0", "xbad%ver"));
         $this->assertFalse(Operators::apply("semVerGreaterThan", "2.0.0", "xbad%ver"));
+
+        // numeric values are always invalid - must be a string
+        $this->assertFalse(Operators::apply("semVerEqual", 2, "2.0.0"));
+        $this->assertFalse(Operators::apply("semVerLessThan", 2, "2.0.1"));
+        $this->assertFalse(Operators::apply("semVerGreaterThan", 3, "2.0.1"));
     }
 
     public function comparisonOperators(): array