Missing warning for wildcard routes in zend.mvc.routing.rst

[spipm]

During a pentest I encountered some routing configuration that used Zend\Mvc\Router\Http\Wildcard as a type. This allowed me to change routing parameters, like the controller. This is a potential security issue, but I can't find a warning for this in the routing documentation. Please add this warning, telling users that using the wildcard type is a potential security issue.

[Ocramius]

We already suggest that Wildcard and Query routes should not be used at all, but we indeed need to make the message more explicit. Ping @DASPRiD

[froschdesign]

@Ocramius
Is the Wildcard route also deprecated? (Currently, this route type is missing in the docs.)

[Ocramius]

@Freeaqingme yes, they should both be avoided, as misuse typically leads to security issues (people using route guards)

[froschdesign]

@Ocramius
Okay, then we must add a hint/warning for this route type.