Add stronger type checks on user input (#378)

sulu · Apr 30, 2024 · 97b00a9 · 97b00a9
1 parent ed1520a
commit 97b00a9
Showing 1 changed file with 11 additions and 9 deletions.
diff --git a/Form/Builder.php b/Form/Builder.php
@@ -100,6 +100,16 @@ public function buildByRequest(Request $request): ?FormInterface
     {
         foreach ($request->request->all() as $key => $parameters) {
             if (0 === \strpos($key, 'dynamic_')) {
+                if (!\is_array($parameters)
+                    || !\is_string($parameters['checksum'] ?? null)
+                    || !\is_string($parameters['type'] ?? null)
+                    || !\is_string($parameters['formId'] ?? null)
+                    || !\is_string($parameters['formName'] ?? null)
+                    || !\is_string($parameters['typeId'] ?? null)
+                ) {
+                    continue;
+                }
+
                 $formNameParts = \explode('dynamic_', $key, 2);
                 $checksumCheck = $this->checksum->check(
                     $parameters['checksum'],
@@ -117,16 +127,8 @@ public function buildByRequest(Request $request): ?FormInterface
                     throw new HttpException(400, 'SuluFormBundle: Checksum not valid!');
                 }
 
-                if (!isset($parameters['type'])
-                    || !isset($parameters['formId'])
-                    || !isset($parameters['formName'])
-                    || !isset($parameters['typeId'])
-                ) {
-                    continue;
-                }
-
                 $locale = $request->getLocale();
-                if (isset($parameters['locale'])) {
+                if (isset($parameters['locale']) && \is_string($parameters['locale'])) {
                     $locale = $parameters['locale'];
                 }