The problem solved by InputBag is that when the URL is https://example.com/something?q[]=faa if you do a ->get('q') you get a 500 error because the query param is an array and not a string (it should be q=faa not q[]=faa). The expected behavior is not a 500 error but a 400 error.

To explain more, the 500 error doesn't result from get('q') itself, but the return value will be an array, the developer might think that the return value is always a string as that's what they are expecting, but it's not. as soon as that variable is passed to a function/method that expects a string, a 500 error will raise.

e.g:

class FooRepository
{
  // code ..

  /**
   * Search for all the foos containing the given keyword.
   */
  public function search(string $keyword): iterable
  {

  }

  // code ...
}

final class FooController extends AbstractController
{
  private FooRepository $foos;

  public function __construct(FooRepository $foos)
  {
    $this->foos = $foos;
  }

  /**
   * @Route('/foo/search', methods={'GET'}, name='foo_search')
   */
  public function search(Request $request): Response
  {
    $keyword = $request->request->get('q', null);
    if (null === $keyword) {
      $foos = [];
    } else {
      $foos = $this->foos->search($keyword);
    }

    // render foos
  }

}

in the example above, the expected value for q( $keyword ), is string ( q=bar ), however, passing an array ( q[]=bar ) will result in a 500 server error.

ÌnputBag is the first step toward fixing this, by triggering a deprecation when an array is encountered, this tells the developer :

if you are expecting this array, use all('q'), if you are expecting a string, ignore this deprecation, Symfony 6 will throw an exception with status code 400 back to the client.

Q	A
Feature PR	symfony/symfony#34363
PR author(s)	@azjezz
Merged in	5.1-dev

Uh oh!

[HttpFoundation] Add InputBag #13543

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions