Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[8.x] Typed route parameters #38466

Closed
wants to merge 3 commits into from
Closed

Conversation

inxilpro
Copy link
Contributor

This PR adds a new routing syntax:

// Before
Route::get('events/{year}/{month}', CalendarMonthController::class))
  ->whereNumber('year')
  ->whereNumber('month');

// After
Route::get('events/{int year}/{int month}', CalendarMonthController::class));

As well as a way to register your own parameter "types":

Route::addParameterType('month', '(0?[1-9]|1[0-2])');
Route::addParameterType('year', '2[0-9]{3}');

Route::get('events/{year yr}/{month mo}', CalendarMonthController::class));

You can mix and match with the other routing syntax as needed:

// Will trigger a 404 before ever querying the database if passed an invalid UUID

Route::get('events/{uuid event:uuid}', EventController::class));

The backstory of this is that we run a bug bounty program, and are constantly hit with requests like:

GET /events/XfWya5t4'));select%20pg_sleep(27);%20--%20/6/-3

And while it's possible to add where() or whereNumber()/etc to each of those routes, it will at least double the length of our routes files. Adding "type hints" inline means that I can easily type my route parameters in the URL definition using a syntax that feels like the PHP type syntax.

@taylorotwell
Copy link
Member

Thanks for your pull request to Laravel!

Unfortunately, I'm going to delay merging this code for now. To preserve our ability to adequately maintain the framework, we need to be very careful regarding the amount of code we include.

If possible, please consider releasing your code as a package so that the community can still take advantage of your contributions!

If you feel absolutely certain that this code corrects a bug in the framework, please "@" mention me in a follow-up comment with further explanation so that GitHub will send me a notification of your response.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants