Refuses a salt that could break out of the PHP string literal it is about to become.
hashSaltAssignment builds source code, so an unchecked value is an injection into
settings.php. The mint only ever produces base64url, which makes this cheap -- but a stored value
arrives from the database, and "it can only be what we wrote" is exactly the assumption worth
refusing to make about a file that gets executed.
Refuses a salt that could break out of the PHP string literal it is about to become.
hashSaltAssignment builds source code, so an unchecked value is an injection into settings.php. The mint only ever produces base64url, which makes this cheap -- but a stored value arrives from the database, and "it can only be what we wrote" is exactly the assumption worth refusing to make about a file that gets executed.