core icon indicating copy to clipboard operation
core copied to clipboard

Query parameters with multiple values are not validated

Open stefankleff opened this issue 3 years ago • 1 comments

API Platform version(s) affected: v2.6.8

Description
Query parameters with multiple values are not validated.

How to reproduce

  1. Create an entity with attribute $foo with a filter and swagger description to activate a validator (eg. enum, maxLength, pattern, etc.)
  2. Make a request with acme.com/path_to_entity?foo[]=bar

Expected: All values of "foo" are validated against the swagger description.

Actual: Validation is not executed at all

Additional Context
https://github.com/api-platform/core/blob/v2.6.8/src/Filter/QueryParameterValidator.php#L57 is calling the validators with a map of either a) key => value or b) key => [value1, value2]

All validators do only support option a) like the pattern validator: https://github.com/api-platform/core/blob/v2.6.8/src/Filter/Validator/Pattern.php#L24 Option b) is discarded because $value is of type array and is rejected by the if-clause.

stefankleff avatar Jun 22 '22 16:06 stefankleff

Yup, I stumbled upon the same problem. It is also worth noticing that SearchFilterTrait is building the filter description and I have a strong feeling that it is not possible to configure (via the filter attribute) the additional ['swagger']['pattern'] which is used in Pattern::validate.

https://github.com/api-platform/core/blob/4fe0821fb1b4760606b739040aedd862dd214087/src/Doctrine/Common/Filter/SearchFilterTrait.php#L77-L84

The workaround may be to add a custom search filter (extend the vendor one), iterate over descriptions created by a parent SearchFilter class, and add an additional swagger pattern.

igornast avatar Jun 23 '22 06:06 igornast

@aegypius has a fix for this IIRC

soyuka avatar Oct 17 '23 09:10 soyuka