[5.6] hash_equals(): Expected user_string to be a string, null given

[hedii]

I am seeing random hash_equals(): Expected user_string to be a string, null given on my monitoring panel (see the log message at the end of this PR).

A user is probably messing with my app signed url, removing the value of the query parameter "signature".

Doing so, with the url /foo/bar?signature=, we get null for the result of $request->query('signature', '') (https://github.com/illuminate/routing/blob/1e05259a8fa573413f8e12c3646a923d188f65c0/UrlGenerator.php#L354)

To be sure to pass a string as the 2nd argument of the function hash_equals, I added a typecast before it.

{  
   "class":"ErrorException",
   "message":"hash_equals(): Expected user_string to be a string, null given",
   "code":0,
   "file":"/var/www/html/xxxxx/releases/20181012090421Z/vendor/laravel/framework/src/Illuminate/Routing/UrlGenerator.php:354",
   "trace":[  
      "{\"function\":\"handleError\",\"class\":\"Illuminate\\\\Foundation\\\\Bootstrap\\\\HandleExceptions\",\"type\":\"->\",\"args\":[2,\"hash_equals(): Expected user_string to be a string, null given\",\"/var/www/html/xxxxx/releases/20181012090421Z/vendor/laravel/framework/src/Illuminate/Routing/UrlGenerator.php\",354,{\"request\":\"[object] (Illuminate\\\\Http\\\\Request: GET /files/tmp/20181015054425_b4c2e711-6dd1-45a5-9009-f6fd143971e9?expires=1539582573&signature= HTTP/1.1\\r\\nAccept:          */*\\r\\nAccept-Encoding: gzip, deflate\\r\\nConnection:      Keep-Alive\\r\\nContent-Length:  \\r\\nContent-Type:    \\r\\nHost:            xxxxx\\r\\nUser-Agent:      NSPlayer/12.0.7600.16385 WMFSDK/12.0\\r\\n\\r\\n)\",\"original\":\"https://xxxxx/files/tmp/20181015054425_b4c2e711-6dd1-45a5-9009-f6fd143971e9?expires=1539582573\",\"expires\":\"1539582573\",\"signature\":\"474b6866268ae4cc68f9a279d8157a89ac350d9e1d1d46d1bcf2a65317255232\"}]}",
      "/var/www/html/xxxxx/releases/20181012090421Z/vendor/laravel/framework/src/Illuminate/Routing/UrlGenerator.php:354",
      "/var/www/html/xxxxx/releases/20181012090421Z/vendor/laravel/framework/src/Illuminate/Support/Facades/Facade.php:223",
      "/var/www/html/xxxxx/releases/20181012090421Z/vendor/laravel/framework/src/Illuminate/Foundation/Providers/FoundationServiceProvider.php:53",
      "......"
   ]
}

[ankurk91]

$request->query('signature', '')

the second argument in query() method ensures that it will return empty string when there is no value specified in url.

[hedii]

@ankurk91 it does not if the request has the query, but with an empty value: /foo/bar?signature=&foo=bar gives $request->query('signature', '') === null

[ankurk91]

I just tested this and i agree with you.
This should be patched in newer versions [5.7] as well.

PS ConvertEmptyStringsToNull middleware is doing converting string to null

[GrahamCampbell]

Thanks. I'll make sure this PR gets merged forward too.