FriendsOfSymfony / FOSJsRoutingBundle

A pretty nice way to expose your Symfony routing to client applications.
1.48k stars 261 forks source link

Controller / validate `callback` query parameter #396

Closed dmaicher closed 3 years ago

dmaicher commented 3 years ago

For some reason we are receiving some weird requests by some clients where the callback query parameter is an array and not a simple string:

/js/routing?callback[$dtfy]=fos.Router.setData

This leads to

Warning: explode() expects parameter 2 to be string, array given
.../vendor/friendsofsymfony/jsrouting-bundle/Controller/Controller.php:109

So I think we should validate here that we get a string and throw a BadRequestHttpException else: https://github.com/FriendsOfSymfony/FOSJsRoutingBundle/blob/master/Controller/Controller.php#L107