From b3bc1c0b489b813b13e600172b736d879d161b6c Mon Sep 17 00:00:00 2001
From: Rodrigo <rodrigoquelca@gmail.com>
Date: Thu, 30 Jul 2026 13:22:41 -0400
Subject: [PATCH] FOUR-32465: [Octane] CRITICAL Data Leaks Between Requests
 "$uid2id"

---
 .../Nayra/Repositories/EntityRepository.php   | 10 +--
 .../Repositories/EntityRepositoryTest.php     | 66 +++++++++++++++++++
 2 files changed, 71 insertions(+), 5 deletions(-)
 create mode 100644 tests/unit/ProcessMaker/Nayra/Repositories/EntityRepositoryTest.php

diff --git a/ProcessMaker/Nayra/Repositories/EntityRepository.php b/ProcessMaker/Nayra/Repositories/EntityRepository.php
index 4b10af1a02..2f84e55b7e 100644
--- a/ProcessMaker/Nayra/Repositories/EntityRepository.php
+++ b/ProcessMaker/Nayra/Repositories/EntityRepository.php
@@ -11,7 +11,7 @@
 
 abstract class EntityRepository
 {
-    private static $uid2id = ['requests' =>[], 'tokens' =>[]];
+    private $uid2id = ['requests' =>[], 'tokens' =>[]];
 
     abstract public function create(array $transaction): ? Model;
 
@@ -41,16 +41,16 @@ public function resolveId(string $uid): int
         }
 
         // Get record if is not stored previously
-        if (!isset(self::$uid2id[$type][$uid])) {
+        if (!isset($this->uid2id[$type][$uid])) {
             $record = $instance->select('id')->where('uuid', $uid)->first();
             if ($record) {
-                self::$uid2id[$type][$uid] = $record->getKey();
+                $this->uid2id[$type][$uid] = $record->getKey();
             } else {
                 throw new Exception("The uid {$uid} does not exist in the database");
             }
         }
 
-        return self::$uid2id[$type][$uid] ?? 0;
+        return $this->uid2id[$type][$uid] ?? 0;
     }
 
     /**
@@ -71,6 +71,6 @@ public function storeUid(string $uid, int $id): void
                 break;
         }
 
-        self::$uid2id[$type][$uid] = $id;
+        $this->uid2id[$type][$uid] = $id;
     }
 }
diff --git a/tests/unit/ProcessMaker/Nayra/Repositories/EntityRepositoryTest.php b/tests/unit/ProcessMaker/Nayra/Repositories/EntityRepositoryTest.php
new file mode 100644
index 0000000000..29986e2f77
--- /dev/null
+++ b/tests/unit/ProcessMaker/Nayra/Repositories/EntityRepositoryTest.php
@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit\ProcessMaker\Nayra\Repositories;
+
+use Illuminate\Database\Eloquent\Model;
+use ProcessMaker\Nayra\Repositories\EntityRepository;
+use ReflectionProperty;
+use Tests\TestCase;
+
+class EntityRepositoryTest extends TestCase
+{
+    /**
+     * Create a concrete implementation of EntityRepository for testing.
+     */
+    private function createRepository(): EntityRepository
+    {
+        return new class extends EntityRepository {
+            public function create(array $transaction): ?Model
+            {
+                return null;
+            }
+
+            public function update(array $transaction): ?Model
+            {
+                return null;
+            }
+
+            public function save(array $transaction): ?Model
+            {
+                return null;
+            }
+        };
+    }
+
+    /**
+     * Test that $uid2id is NOT a static property (fix for Octane data leak).
+     *
+     * In Octane, static properties persist across requests. The critical fix
+     * changes $uid2id from "private static" to "private" so that each instance
+     * has its own isolated cache, preventing data leaks between requests.
+     */
+    public function test_uid2id_is_not_static(): void
+    {
+        $reflection = new ReflectionProperty(EntityRepository::class, 'uid2id');
+
+        $this->assertFalse(
+            $reflection->isStatic(),
+            'uid2id must NOT be static to prevent data leaks between requests in Octane'
+        );
+    }
+
+    /**
+     * Test that $uid2id is a private property.
+     */
+    public function test_uid2id_is_private(): void
+    {
+        $reflection = new ReflectionProperty(EntityRepository::class, 'uid2id');
+
+        $this->assertTrue(
+            $reflection->isPrivate(),
+            'uid2id should be private'
+        );
+    }
+}