appsec/laravel: be more defensive

[cataphract]

Just doing isset($user['username']) is not safe is $user doesn't implement ArrayAccess.

php > class A {}
php > $a = new A;
php > var_dump(isset($a['x']));
PHP Warning: Uncaught Error: Cannot use object of type A as array in php shell code:1 Stack trace:
thrown in php shell code on line 1

Description

Reviewer checklist

• Test coverage seems ok.
• Appropriate labels assigned.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.69%. Comparing base (0c35caf) to head (05af36e).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3503      +/-   ##
==========================================
- Coverage   61.80%   61.69%   -0.11%     
==========================================
  Files         142      142              
  Lines       12923    12923              
  Branches     1695     1695              
==========================================
- Hits         7987     7973      -14     
- Misses       4183     4196      +13     
- Partials      753      754       +1     

Files with missing lines	Coverage Δ
appsec/src/extension/php_helpers.c	77.21% <100.00%> (ø)

... and 3 files with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0c35caf...05af36e. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pr-commenter]

Benchmarks [ appsec ]

Benchmark execution time: 2025-11-26 18:43:47

Comparing candidate commit 05af36e in PR branch glopes/appsec-laravel-fix with baseline commit 0c35caf in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics.

[pr-commenter]

Benchmarks [ tracer ]

Benchmark execution time: 2025-11-26 19:11:03

Comparing candidate commit 05af36e in PR branch glopes/appsec-laravel-fix with baseline commit 0c35caf in branch master.

Found 2 performance improvements and 1 performance regressions! Performance is the same for 191 metrics, 0 unstable metrics.

scenario:ComposerTelemetryBench/benchTelemetryParsing-opcache

• 🟩 execution_time [-1306.061ns; -293.939ns] or [-9.894%; -2.227%]

scenario:MessagePackSerializationBench/benchMessagePackSerialization-opcache

• 🟥 execution_time [+2.852µs; +3.768µs] or [+2.705%; +3.573%]

scenario:TraceSerializationBench/benchSerializeTrace

• 🟩 execution_time [-46.617µs; -34.883µs] or [-10.244%; -7.666%]