Files
archived-http-kernel/Controller/ArgumentResolver/RequestAttributeValueResolver.php
Mudassar e1578f043c [HttpKernel] Validate typed request attribute values before calling controllers
When a route parameter is bound to a typed controller argument (int, float, bool, string, or \BackedEnum), invalid or out-of-range values now result in an HTTP error instead of triggering a TypeError.
2026-02-05 16:15:40 +01:00

70 lines
2.2 KiB
PHP

<?php
/*
* This file is part of the Symfony package.
*
* (c) Fabien Potencier <fabien@symfony.com>
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace Symfony\Component\HttpKernel\Controller\ArgumentResolver;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpKernel\Controller\ValueResolverInterface;
use Symfony\Component\HttpKernel\ControllerMetadata\ArgumentMetadata;
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
/**
* Yields a non-variadic argument's value from the request attributes.
*
* @author Iltar van der Berg <kjarli@gmail.com>
*/
final class RequestAttributeValueResolver implements ValueResolverInterface
{
public function resolve(Request $request, ArgumentMetadata $argument): array
{
if ($argument->isVariadic()) {
return [];
}
$name = $argument->getName();
if (!$request->attributes->has($name)) {
return [];
}
$value = $request->attributes->get($name);
if (null === $value && $argument->isNullable()) {
return [null];
}
$type = $argument->getType();
// Skip when no type declaration or complex types; fall back to other resolvers/defaults
if (null === $type || str_contains($type, '|') || str_contains($type, '&')) {
return [$value];
}
if ('string' === $type) {
if (!\is_scalar($value) && !$value instanceof \Stringable) {
throw new NotFoundHttpException(\sprintf('The value for the "%s" route parameter is invalid.', $name));
}
$value = (string) $value;
} elseif ($filter = match ($type) {
'int' => \FILTER_VALIDATE_INT,
'float' => \FILTER_VALIDATE_FLOAT,
'bool' => \FILTER_VALIDATE_BOOL,
default => null,
}) {
if (null === $value = $request->attributes->filter($name, null, $filter, ['flags' => \FILTER_NULL_ON_FAILURE | \FILTER_REQUIRE_SCALAR])) {
throw new NotFoundHttpException(\sprintf('The value for the "%s" route parameter is invalid.', $name));
}
}
return [$value];
}
}