Skip to content

[Form] User datas are not sufficiently checked #1962

Closed
@hlecorche

Description

@hlecorche

TextType has no ClientTransformer. Why ?

With TextType, the client data can be any type !!!! (array eg)

In the example below, if the user data (when sending the form) is an array, the exception "Expected argument of type string, array given in src\Symfony\Component\Validator\Constraints\MaxLengthValidator.php at line 40" is thrown

class Car
{
    /**
     *
     * @Assert\Type("string")
     * @Assert\MaxLength(5)
     */
    public $name;
}
public function bugAction(Request $request)
    {
        $car = new Car();
        $form = $this->createFormBuilder($car)
            ->add('name', 'text')
            ->getForm();

        if ($request->getMethod() == 'POST') {
            $form->bindRequest($request);

            if ($form->isValid()) {
                // perform some action, such as saving the task to the database
            }
        }

        return array('form' => $form->createView());
    }

Second question: Why ScalarToChoiceTransformer does not check if the data (in reverseTransform function) is a scalar value?

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions