core
core copied to clipboard
Query parameters with multiple values are not validated
API Platform version(s) affected: v2.6.8
Description
Query parameters with multiple values are not validated.
How to reproduce
- Create an entity with attribute $foo with a filter and swagger description to activate a validator (eg. enum, maxLength, pattern, etc.)
- Make a request with acme.com/path_to_entity?foo[]=bar
Expected: All values of "foo" are validated against the swagger description.
Actual: Validation is not executed at all
Additional Context
https://github.com/api-platform/core/blob/v2.6.8/src/Filter/QueryParameterValidator.php#L57 is calling the validators with a map of either a) key => value or b) key => [value1, value2]
All validators do only support option a) like the pattern validator: https://github.com/api-platform/core/blob/v2.6.8/src/Filter/Validator/Pattern.php#L24 Option b) is discarded because $value is of type array and is rejected by the if-clause.
Yup, I stumbled upon the same problem. It is also worth noticing that SearchFilterTrait is building the filter description and I have a strong feeling that it is not possible to configure (via the filter attribute) the additional ['swagger']['pattern'] which is used in Pattern::validate.
https://github.com/api-platform/core/blob/4fe0821fb1b4760606b739040aedd862dd214087/src/Doctrine/Common/Filter/SearchFilterTrait.php#L77-L84
The workaround may be to add a custom search filter (extend the vendor one), iterate over descriptions created by a parent SearchFilter class, and add an additional swagger pattern.
@aegypius has a fix for this IIRC