remove the undocumented dot keys support

laravel · May 11, 2020 · 4a4a7e1 · 4a4a7e1
1 parent 95b34d4
commit 4a4a7e1
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 10 deletions.
diff --git a/src/Illuminate/Validation/Validator.php b/src/Illuminate/Validation/Validator.php
@@ -250,7 +250,7 @@ public function parseData(array $data)
                 $value = $this->parseData($value);
             }
 
-            $key = str_replace(['.', '*'], ['->', '__asterisk__'], $key);
+            $key = str_replace('*', '__asterisk__', $key);
 
             $newData[$key] = $value;
         }
@@ -288,8 +288,6 @@ public function passes()
         // rule. Any error messages will be added to the containers with each of
         // the other error messages, returning true if we don't have messages.
         foreach ($this->rules as $attribute => $rules) {
-            $attribute = str_replace('\.', '->', $attribute);
-
             if ($this->shouldBeExcluded($attribute)) {
                 $this->removeAttribute($attribute);
 

diff --git a/tests/Validation/ValidationValidatorTest.php b/tests/Validation/ValidationValidatorTest.php
@@ -3749,20 +3749,30 @@ public function testValidateImplicitEachWithAsterisksForRequiredNonExistingKey()
         $this->assertFalse($v->passes());
     }
 
-    public function testParsingArrayKeysWithDot()
+    public function testPassingSlashVulnerability()
     {
         $trans = $this->getIlluminateArrayTranslator();
 
-        $v = new Validator($trans, ['foo' => ['bar' => ''], 'foo.bar' => 'valid'], ['foo.bar' => 'required']);
+        $v = new Validator($trans, [
+            'matrix' => ["\\" => ["invalid"], "1\\" => ["invalid"]],
+        ], [
+            'matrix.*.*' => 'integer',
+        ]);
         $this->assertTrue($v->fails());
 
-        $v = new Validator($trans, ['foo' => ['bar' => 'valid'], 'foo.bar' => ''], ['foo\.bar' => 'required']);
-        $this->assertTrue($v->fails());
+        $v = new Validator($trans, [
+            'matrix' => ["\\" => [1], "1\\" => [1]],
+        ], [
+            'matrix.*.*' => 'integer',
+        ]);
+        $this->assertTrue($v->passes());
 
-        $v = new Validator($trans, ['foo' => ['bar.baz' => '']], ['foo.bar\.baz' => 'required']);
-        $this->assertTrue($v->fails());
 
-        $v = new Validator($trans, ['foo' => [['bar.baz' => ''], ['bar.baz' => '']]], ['foo.*.bar\.baz' => 'required']);
+        $v = new Validator($trans, [
+            'foo' => ['bar' => 'valid'], 'foo.bar' => 'invalid', 'foo->bar' => 'valid'
+        ], [
+            'foo\.bar' => 'required|in:valid'
+        ]);
         $this->assertTrue($v->fails());
     }