Required constraint sometimes lets undefined fields through #5

New issue

Open

opened 2023-11-22 13:40:13 +01:00 by vlw · 0 comments

vlw commented

2023-11-22 13:40:13 +01:00

(Migrated from codeberg.org)

With the following Ruleset:

Ruleset->POST([
    (new Rules("id"))
        ->required()
        ->type(Type::STRING),
    
    (new Rules("user"))
        ->required()
        ->type(Type::STRING)
        ->max(128),
    
    (new Rules("active"))
        ->required()
        ->type(Type::BOOLEAN),
    
    (new Rules("expires"))
        ->required()
        ->type(Type::NUMBER)
        ->max(PHP_INT_MAX)
]);

Sending the following data with Reflect PHP Client syntax:

Client->call("endpoint", Method::PUT, [
  "active" => true
]);

Will still let the request through to main() despite a lot of required() rules missing. The missing rules have their $_POST values set to null, so it does at least initialize processing on them.

With the following Ruleset: ```php Ruleset->POST([ (new Rules("id")) ->required() ->type(Type::STRING), (new Rules("user")) ->required() ->type(Type::STRING) ->max(128), (new Rules("active")) ->required() ->type(Type::BOOLEAN), (new Rules("expires")) ->required() ->type(Type::NUMBER) ->max(PHP_INT_MAX) ]); ``` Sending the following data with [Reflect PHP Client](https://github.com/VictorWesterlund/reflect-client-php) syntax: ```php Client->call("endpoint", Method::PUT, [ "active" => true ]); ``` Will still let the request through to `main()` despite a lot of `required()` rules missing. The missing rules have their $_POST values set to null, so it does at least initialize processing on them.