Skip to content

Commit 172f0a7

Browse files
GromNaNnicolas-grekas
GromNaN
authored and
nicolas-grekas
committed
[HttpFoundation] Add ParameterBag::getString() and deprecate accepting invalid values
1 parent 6a7cd16 commit 172f0a7

6 files changed

Lines changed: 311 additions & 26 deletions

File tree

‎UPGRADE-6.3.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,12 @@ HttpFoundation
6363

6464
* `Response::sendHeaders()` now takes an optional `$statusCode` parameter
6565

66+
HttpFoundation
67+
--------------
68+
69+
* Deprecate conversion of invalid values in `ParameterBag::getInt()` and `ParameterBag::getBoolean()`
70+
* Deprecate ignoring invalid values when using `ParameterBag::filter()`, unless flag `FILTER_NULL_ON_FAILURE` is set
71+
6672
HttpKernel
6773
----------
6874

‎src/Symfony/Component/HttpFoundation/CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,14 @@ CHANGELOG
44
6.3
55
---
66

7+
* Calling `ParameterBag::getDigit()`, `getAlnum()`, `getAlpha()` on an `array` throws a `UnexpectedValueException` instead of a `TypeError`
8+
* Add `ParameterBag::getString()` to convert a parameter into string and throw an exception if the value is invalid
79
* Add `ParameterBag::getEnum()`
810
* Create migration for session table when pdo handler is used
911
* Add support for Relay PHP extension for Redis
1012
* The `Response::sendHeaders()` method now takes an optional HTTP status code as parameter, allowing to send informational responses such as Early Hints responses (103 status code)
13+
* Deprecate conversion of invalid values in `ParameterBag::getInt()` and `ParameterBag::getBoolean()`,
14+
* Deprecate ignoring invalid values when using `ParameterBag::filter()`, unless flag `FILTER_NULL_ON_FAILURE` is set
1115

1216
6.2
1317
---

‎src/Symfony/Component/HttpFoundation/InputBag.php‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,15 @@ public function getEnum(string $key, string $class, \BackedEnum $default = null)
9292
}
9393
}
9494

95+
/**
96+
* Returns the parameter value converted to string.
97+
*/
98+
public function getString(string $key, string $default = ''): string
99+
{
100+
// Shortcuts the parent method because the validation on scalar is already done in get().
101+
return (string) $this->get($key, $default);
102+
}
103+
95104
public function filter(string $key, mixed $default = null, int $filter = \FILTER_DEFAULT, mixed $options = []): mixed
96105
{
97106
$value = $this->has($key) ? $this->all()[$key] : $default;
@@ -109,6 +118,22 @@ public function filter(string $key, mixed $default = null, int $filter = \FILTER
109118
throw new \InvalidArgumentException(sprintf('A Closure must be passed to "%s()" when FILTER_CALLBACK is used, "%s" given.', __METHOD__, get_debug_type($options['options'] ?? null)));
110119
}
111120

112-
return filter_var($value, $filter, $options);
121+
$options['flags'] ??= 0;
122+
$nullOnFailure = $options['flags'] & \FILTER_NULL_ON_FAILURE;
123+
$options['flags'] |= \FILTER_NULL_ON_FAILURE;
124+
125+
$value = filter_var($value, $filter, $options);
126+
127+
if (null !== $value || $nullOnFailure) {
128+
return $value;
129+
}
130+
131+
$method = debug_backtrace(\DEBUG_BACKTRACE_IGNORE_ARGS | \DEBUG_BACKTRACE_PROVIDE_OBJECT, 2)[1];
132+
$method = ($method['object'] ?? null) === $this ? $method['function'] : 'filter';
133+
$hint = 'filter' === $method ? 'pass' : 'use method "filter()" with';
134+
135+
trigger_deprecation('symfony/http-foundation', '6.3', 'Ignoring invalid values when using "%s::%s(\'%s\')" is deprecated and will throw a "%s" in 7.0; '.$hint.' flag "FILTER_NULL_ON_FAILURE" to keep ignoring them.', $this::class, $method, $key, BadRequestException::class);
136+
137+
return false;
113138
}
114139
}

‎src/Symfony/Component/HttpFoundation/ParameterBag.php‎

Lines changed: 42 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -114,40 +114,53 @@ public function remove(string $key)
114114
*/
115115
public function getAlpha(string $key, string $default = ''): string
116116
{
117-
return preg_replace('/[^[:alpha:]]/', '', $this->get($key, $default));
117+
return preg_replace('/[^[:alpha:]]/', '', $this->getString($key, $default));
118118
}
119119

120120
/**
121121
* Returns the alphabetic characters and digits of the parameter value.
122122
*/
123123
public function getAlnum(string $key, string $default = ''): string
124124
{
125-
return preg_replace('/[^[:alnum:]]/', '', $this->get($key, $default));
125+
return preg_replace('/[^[:alnum:]]/', '', $this->getString($key, $default));
126126
}
127127

128128
/**
129129
* Returns the digits of the parameter value.
130130
*/
131131
public function getDigits(string $key, string $default = ''): string
132132
{
133-
// we need to remove - and + because they're allowed in the filter
134-
return str_replace(['-', '+'], '', $this->filter($key, $default, \FILTER_SANITIZE_NUMBER_INT));
133+
return preg_replace('/[^[:digit:]]/', '', $this->getString($key, $default));
134+
}
135+
136+
/**
137+
* Returns the parameter as string.
138+
*/
139+
public function getString(string $key, string $default = ''): string
140+
{
141+
$value = $this->get($key, $default);
142+
if (!\is_scalar($value) && !$value instanceof \Stringable) {
143+
throw new \UnexpectedValueException(sprintf('Parameter value "%s" cannot be converted to "string".', $key));
144+
}
145+
146+
return (string) $value;
135147
}
136148

137149
/**
138150
* Returns the parameter value converted to integer.
139151
*/
140152
public function getInt(string $key, int $default = 0): int
141153
{
142-
return (int) $this->get($key, $default);
154+
// In 7.0 remove the fallback to 0, in case of failure an exception will be thrown
155+
return $this->filter($key, $default, \FILTER_VALIDATE_INT, ['flags' => \FILTER_REQUIRE_SCALAR]) ?: 0;
143156
}
144157

145158
/**
146159
* Returns the parameter value converted to boolean.
147160
*/
148161
public function getBoolean(string $key, bool $default = false): bool
149162
{
150-
return $this->filter($key, $default, \FILTER_VALIDATE_BOOL);
163+
return $this->filter($key, $default, \FILTER_VALIDATE_BOOL, ['flags' => \FILTER_REQUIRE_SCALAR]);
151164
}
152165

153166
/**
@@ -178,7 +191,8 @@ public function getEnum(string $key, string $class, \BackedEnum $default = null)
178191
/**
179192
* Filter key.
180193
*
181-
* @param int $filter FILTER_* constant
194+
* @param int $filter FILTER_* constant
195+
* @param int|array{flags?: int, options?: array} $options Flags from FILTER_* constants
182196
*
183197
* @see https://php.net/filter-var
184198
*/
@@ -196,11 +210,31 @@ public function filter(string $key, mixed $default = null, int $filter = \FILTER
196210
$options['flags'] = \FILTER_REQUIRE_ARRAY;
197211
}
198212

213+
if (\is_object($value) && !$value instanceof \Stringable) {
214+
throw new \UnexpectedValueException(sprintf('Parameter value "%s" cannot be filtered.', $key));
215+
}
216+
199217
if ((\FILTER_CALLBACK & $filter) && !(($options['options'] ?? null) instanceof \Closure)) {
200218
throw new \InvalidArgumentException(sprintf('A Closure must be passed to "%s()" when FILTER_CALLBACK is used, "%s" given.', __METHOD__, get_debug_type($options['options'] ?? null)));
201219
}
202220

203-
return filter_var($value, $filter, $options);
221+
$options['flags'] ??= 0;
222+
$nullOnFailure = $options['flags'] & \FILTER_NULL_ON_FAILURE;
223+
$options['flags'] |= \FILTER_NULL_ON_FAILURE;
224+
225+
$value = filter_var($value, $filter, $options);
226+
227+
if (null !== $value || $nullOnFailure) {
228+
return $value;
229+
}
230+
231+
$method = debug_backtrace(\DEBUG_BACKTRACE_IGNORE_ARGS | \DEBUG_BACKTRACE_PROVIDE_OBJECT, 2)[1];
232+
$method = ($method['object'] ?? null) === $this ? $method['function'] : 'filter';
233+
$hint = 'filter' === $method ? 'pass' : 'use method "filter()" with';
234+
235+
trigger_deprecation('symfony/http-foundation', '6.3', 'Ignoring invalid values when using "%s::%s(\'%s\')" is deprecated and will throw an "%s" in 7.0; '.$hint.' flag "FILTER_NULL_ON_FAILURE" to keep ignoring them.', $this::class, $method, $key, \UnexpectedValueException::class);
236+
237+
return false;
204238
}
205239

206240
/**

‎src/Symfony/Component/HttpFoundation/Tests/InputBagTest.php‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,15 @@
1212
namespace Symfony\Component\HttpFoundation\Tests;
1313

1414
use PHPUnit\Framework\TestCase;
15+
use Symfony\Bridge\PhpUnit\ExpectDeprecationTrait;
1516
use Symfony\Component\HttpFoundation\Exception\BadRequestException;
1617
use Symfony\Component\HttpFoundation\InputBag;
1718
use Symfony\Component\HttpFoundation\Tests\Fixtures\FooEnum;
1819

1920
class InputBagTest extends TestCase
2021
{
22+
use ExpectDeprecationTrait;
23+
2124
public function testGet()
2225
{
2326
$bag = new InputBag(['foo' => 'bar', 'null' => null, 'int' => 1, 'float' => 1.0, 'bool' => false, 'stringable' => new class() implements \Stringable {
@@ -36,6 +39,58 @@ public function __toString(): string
3639
$this->assertFalse($bag->get('bool'), '->get() gets the value of a bool parameter');
3740
}
3841

42+
/**
43+
* @group legacy
44+
*/
45+
public function testGetIntError()
46+
{
47+
$this->expectDeprecation('Since symfony/http-foundation 6.3: Ignoring invalid values when using "Symfony\Component\HttpFoundation\InputBag::getInt(\'foo\')" is deprecated and will throw a "Symfony\Component\HttpFoundation\Exception\BadRequestException" in 7.0; use method "filter()" with flag "FILTER_NULL_ON_FAILURE" to keep ignoring them.');
48+
49+
$bag = new InputBag(['foo' => 'bar']);
50+
$result = $bag->getInt('foo');
51+
$this->assertSame(0, $result);
52+
}
53+
54+
/**
55+
* @group legacy
56+
*/
57+
public function testGetBooleanError()
58+
{
59+
$this->expectDeprecation('Since symfony/http-foundation 6.3: Ignoring invalid values when using "Symfony\Component\HttpFoundation\InputBag::getBoolean(\'foo\')" is deprecated and will throw a "Symfony\Component\HttpFoundation\Exception\BadRequestException" in 7.0; use method "filter()" with flag "FILTER_NULL_ON_FAILURE" to keep ignoring them.');
60+
61+
$bag = new InputBag(['foo' => 'bar']);
62+
$result = $bag->getBoolean('foo');
63+
$this->assertFalse($result);
64+
}
65+
66+
public function testGetString()
67+
{
68+
$bag = new InputBag(['integer' => 123, 'bool_true' => true, 'bool_false' => false, 'string' => 'abc', 'stringable' => new class() implements \Stringable {
69+
public function __toString(): string
70+
{
71+
return 'strval';
72+
}
73+
}]);
74+
75+
$this->assertSame('123', $bag->getString('integer'), '->getString() gets a value of parameter as string');
76+
$this->assertSame('abc', $bag->getString('string'), '->getString() gets a value of parameter as string');
77+
$this->assertSame('', $bag->getString('unknown'), '->getString() returns zero if a parameter is not defined');
78+
$this->assertSame('foo', $bag->getString('unknown', 'foo'), '->getString() returns the default if a parameter is not defined');
79+
$this->assertSame('1', $bag->getString('bool_true'), '->getString() returns "1" if a parameter is true');
80+
$this->assertSame('', $bag->getString('bool_false', 'foo'), '->getString() returns an empty empty string if a parameter is false');
81+
$this->assertSame('strval', $bag->getString('stringable'), '->getString() gets a value of a stringable paramater as string');
82+
}
83+
84+
public function testGetStringExceptionWithArray()
85+
{
86+
$bag = new InputBag(['key' => ['abc']]);
87+
88+
$this->expectException(BadRequestException::class);
89+
$this->expectExceptionMessage('Input value "key" contains a non-scalar value.');
90+
91+
$bag->getString('key');
92+
}
93+
3994
public function testGetDoesNotUseDeepByDefault()
4095
{
4196
$bag = new InputBag(['foo' => ['bar' => 'moo']]);
@@ -126,4 +181,34 @@ public function testGetEnumThrowsExceptionWithInvalidValue()
126181

127182
$this->assertNull($bag->getEnum('invalid-value', FooEnum::class));
128183
}
184+
185+
public function testGetAlnumExceptionWithArray()
186+
{
187+
$bag = new InputBag(['word' => ['foo_BAR_012']]);
188+
189+
$this->expectException(BadRequestException::class);
190+
$this->expectExceptionMessage('Input value "word" contains a non-scalar value.');
191+
192+
$bag->getAlnum('word');
193+
}
194+
195+
public function testGetAlphaExceptionWithArray()
196+
{
197+
$bag = new InputBag(['word' => ['foo_BAR_012']]);
198+
199+
$this->expectException(BadRequestException::class);
200+
$this->expectExceptionMessage('Input value "word" contains a non-scalar value.');
201+
202+
$bag->getAlpha('word');
203+
}
204+
205+
public function testGetDigitsExceptionWithArray()
206+
{
207+
$bag = new InputBag(['word' => ['foo_BAR_012']]);
208+
209+
$this->expectException(BadRequestException::class);
210+
$this->expectExceptionMessage('Input value "word" contains a non-scalar value.');
211+
212+
$bag->getDigits('word');
213+
}
129214
}

0 commit comments

Comments
 (0)