Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IdnaEncoder::encode(): add input validation #592

Merged
merged 1 commit into from
Nov 8, 2021

Conversation

jrfnl
Copy link
Member

@jrfnl jrfnl commented Nov 6, 2021

The IdnaEncoder::encode() is the official entry point for this class, even though there are more public methods (of which it is questionable whether they should be public, but changing that now would be a BC-break).

The documented accepted parameter type is string, but no input validation was done on the parameter, which could lead to various PHP errors, most notably a "passing null to non-nullable" deprecation notice on PHP 8.1.

This commit adds input validation to the IdnaEncoder::encode() method, allowing only for strings and stringable objects.

While this is stricter than previously, only a string could result in a valid return value, so in my opinion, being strict is warranted.

Includes adding perfunctory tests for the new exception.

The `IdnaEncoder::encode()` is the official entry point for this class, even though there are more public methods (of which it is questionable whether they should be public, but changing that now would be a BC-break).

The documented accepted parameter type is `string`, but no input validation was done on the parameter, which could lead to various PHP errors, most notably a "passing null to non-nullable" deprecation notice on PHP 8.1.

This commit adds input validation to the `IdnaEncoder::encode()` method, allowing only for strings and _stringable_ objects.

While this is stricter than previously, only a string could result in a valid return value, so in my opinion, being strict is warranted.

Includes adding perfunctory tests for the new exception.
@jrfnl jrfnl added this to the 2.0.0 milestone Nov 6, 2021
@jrfnl jrfnl mentioned this pull request Nov 6, 2021
28 tasks
@jrfnl
Copy link
Member Author

jrfnl commented Nov 7, 2021

Open question: Should this method/class allow for Stringable objects ? The current implementation allows for it, but we may want to elect not to support Stringable objects as input.

@schlessera
Copy link
Member

Should this method/class allow for Stringable objects ?

I'd vote for yes, as there is no technical reason not to accept them.

@schlessera schlessera merged commit 9d3b445 into develop Nov 8, 2021
@schlessera schlessera deleted the feature/idnaencoder-add-input-validation branch November 8, 2021 08:42
@jrfnl
Copy link
Member Author

jrfnl commented Nov 8, 2021

Should this method/class allow for Stringable objects ?

I'd vote for yes, as there is no technical reason not to accept them.

Well, the technical reason not to accept them would be that we won't be able to add type declarations to functions accepting string|Stringable until PHP 8.0 (i.e. more likely to happen in Requests 4.0 or 5.0, not 3.0)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants