[abdulmajidcse]

Summary

Three security hardening fixes.

Client property writes

• Component::syncProperty() (used for bound values m and property updates t=u) now only accepts the component's tracked public properties.
• Protected/private properties, including Ripple's own bookkeeping (locked, tracked, eventListeners, …), can no longer be set from the client. This keeps #[Locked] and the #[Invokable] allow-list intact.

State signatures

• The state signature now covers the component class as well as the id and state, encoded as JSON.
• update() verifies against the resolved class, so a snapshot signed for one component is rejected for another.
• StateSigner::sign() / verify() take the class as a new argument. ComponentManager::signState() signs with the class resolved the same way update() does (used by Testable).

Soft navigation

• The navigation fetch uses mode: 'same-origin', so a redirect to another origin falls back to a normal browser navigation.
• Only same-origin text/html responses are swapped into the document. Anything else (JSON, plain text, files) is loaded normally.

Notes

• Breaking: code calling StateSigner::sign() / verify() directly must pass the component class.
• Snapshots signed before upgrading no longer verify; open pages need a reload after deploy.
• resources/dist/ripple.min.js is rebuilt from source.

Tests

• New ClientWriteProtectionTest with a SecureComponent fixture covering protected-property writes, listener registration, property updates on internals, cross-component signature replay and class normalisation.
• Existing signer tests updated for the class argument.
• composer test (162 tests), composer analyse and composer cs-check pass.

[techmahedy]

@abdulmajidcse need to update docs after merging this PR?

[abdulmajidcse]

@techmahedy Yes. The docs need small updates for the new class-bound state signature, the upgrade/reload requirement, and the same-origin HTML-only soft-navigation behavior. I’ll update the 4.x Security, Wire Protocol, Deployment, and Navigation pages.

[techmahedy]

@techmahedy Yes. The docs need small updates for the new class-bound state signature, the upgrade/reload requirement, and the same-origin HTML-only soft-navigation behavior. I’ll update the 4.x Security, Wire Protocol, Deployment, and Navigation pages.

@abdulmajidcse ok, please update it as well.

[abdulmajidcse]

@techmahedy The documentation updates are ready in https://github.com/doppar/ripple.doppar.com/pull/1. It covers the class-bound state signature, upgrade/reload requirement, updated StateSigner API signatures, and same-origin HTML-only soft navigation behavior.

[techmahedy]

@techmahedy The documentation updates are ready in doppar/ripple.doppar.com#1. It covers the class-bound state signature, upgrade/reload requirement, updated StateSigner API signatures, and same-origin HTML-only soft navigation behavior.

@abdulmajidcse thanks

[xentixar]

Looks good, thank you, @abdulmajidcse.

[abdulmajidcse]

@xentixar The merge conflict with 4.x has been resolved and pushed. The original security changes remain intact, and the full suite passes: 181 tests, 1165 assertions. The JavaScript bundle also rebuilds successfully. Please take another look when you have a chance.