[FrameworkBundle] Forbid env parameters in routing configuration

symfony · Nov 29, 2016 · 8d80628 · 8d80628
1 parent 8a377bb
commit 8d80628
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 0 deletions.
diff --git a/Routing/Router.php b/Routing/Router.php
@@ -146,6 +146,10 @@ private function resolve($value)
                 return '%%';
             }
 
+            if (preg_match('/^env\(\w+\)$/', $match[1])) {
+                throw new RuntimeException(sprintf('Using "%%%s%%" is not allowed in routing configuration.', $match[1]));
+            }
+
             $resolved = $container->getParameter($match[1]);
 
             if (is_string($resolved) || is_numeric($resolved)) {

diff --git a/Tests/Routing/RouterTest.php b/Tests/Routing/RouterTest.php
@@ -131,6 +131,20 @@ public function testPatternPlaceholders()
         );
     }
 
+    /**
+     * @expectedException \Symfony\Component\DependencyInjection\Exception\RuntimeException
+     * @expectedExceptionMessage Using "%env(FOO)%" is not allowed in routing configuration.
+     */
+    public function testEnvPlaceholders()
+    {
+        $routes = new RouteCollection();
+
+        $routes->add('foo', new Route('/%env(FOO)%'));
+
+        $router = new Router($this->getServiceContainer($routes), 'foo');
+        $router->getRouteCollection();
+    }
+
     public function testHostPlaceholders()
     {
         $routes = new RouteCollection();