[Security] Do not throw exception for a non-existing route defined in `_target_path` when login

**Symfony version(s) affected**: 5.3.x and I guess 4.4.x

**Description**


When [using `_target_path` in a login](https://symfony.com/doc/current/security/form_login.html#control-the-redirect-using-request-parameters), if the value is a non-existing route it throws a `Symfony\Component\Routing\Exception\
RouteNotFoundException`.

**How to reproduce**
In a login form allowing `_target_path`, modify the value to send a value which is not a route and neither starts with `http`.

**Possible Solution**
I guess if the value is not starting with `http`, it could be checked if it's an existing route and if not set the `$path` to `/` in

https://github.com/symfony/symfony/blob/732acf56fd6e0a6a3af57595a724728b959a5cbf/src/Symfony/Component/Security/Http/HttpUtils.php#L61-L70

or catch the `RouteNotFoundException` and redirect to `/` maybe.

**Additional context**

![image](https://user-images.githubusercontent.com/720690/137734730-ac975deb-b1ad-4e8e-a0b1-54878863834f.png)

I came across this when someone tried to set `_target_path` to `<script>something</script>` (which does nothing because it's just used as a key from an array).

	public function createRedirectResponse(Request $request, string $path, int $status = 302)
	{
	if (null !== $this->secureDomainRegexp && 'https' === $this->urlMatcher->getContext()->getScheme() && preg_match('#^https?:[/\\\\]{2,}+[^/]++#i', $path, $host) && !preg_match(sprintf($this->secureDomainRegexp, preg_quote($request->getHttpHost())), $host[0])) {
	$path = '/';
	}
	if (null !== $this->domainRegexp && preg_match('#^https?:[/\\\\]{2,}+[^/]++#i', $path, $host) && !preg_match(sprintf($this->domainRegexp, preg_quote($request->getHttpHost())), $host[0])) {
	$path = '/';
	}

	return new RedirectResponse($this->generateUri($request, $path), $status);

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

[Security] Do not throw exception for a non-existing route defined in `_target_path` when login #43567

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Uh oh!

[Security] Do not throw exception for a non-existing route defined in _target_path when login #43567

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[Security] Do not throw exception for a non-existing route defined in `_target_path` when login #43567