Report unknown size instead of passing false or 0 bytes to the inner validator - #1843
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1843 +/- ##
============================================
- Coverage 97.16% 97.14% -0.03%
- Complexity 1087 1096 +9
============================================
Files 198 198
Lines 2542 2554 +12
============================================
+ Hits 2470 2481 +11
- Misses 72 73 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
6966376 to
d0c5f5b
Compare
|
Looks good to me! Thanks for your contribution 🐼 I'll wait a couple of days to give a chance for @henriquemoody to review it. I would probably remove the This will probably be in either |
d0c5f5b to
3d205ba
Compare
|
Thank you for the quick response, I deleted the comments with a ammend. I can wait til the next |
"Size" cast the result of "filesize()" to an integer, so a filename that does not exist or is not readable became a size of 0 bytes, and every "lessThan" style validation passed on a file that was never there. "SplFileInfo::getSize()" throws when "stat" fails, which surfaced as an uncaught "RuntimeException", and PSR-7 streams and uploaded files may legitimately report NULL, which was passed along to the inner validator. Input types are now checked up front, so unsupported types still report "TEMPLATE_WRONG_TYPE", and inputs of a supported type whose size cannot be determined report the new "TEMPLATE_UNKNOWN_SIZE".
3d205ba to
f78e012
Compare
|
Nits applied, thanks for the review. |
Sizecasted the return offilesize()to an integer, and(int) false === 0, so afilename that does not exist or is not readable validated as 0 bytes. Every upper-bound
check passed on a file that was never there:
SplFileInfo::getSize()throws whenstatfails, so the same missing file escaped as anuncaught
RuntimeExceptioninstead of a validation failure; its documented return type isint|false, so overrides may returnfalserather than throw (Symfony'sStreamdoes exactly that). PSR-7 streams and uploaded files may legitimately report
nullfor anunknown size, and that was reported as
TEMPLATE_WRONG_TYPE, which is misleading: the typeis fine, only the size is not knowable.
Check the input type up front, so unsupported types keep reporting
TEMPLATE_WRONG_TYPE,and report a supported input whose size cannot be determined under the new
TEMPLATE_UNKNOWN_SIZE. Guardfilesize(), catch theRuntimeExceptionfromSplFileInfoand narrow every
getSize()result withis_int().getSize()was also being called twiceper evaluation; it is now called once.
Inputs that previously validated against a bogus 0 now fail, which is a behaviour change. The existing
template constant and message are untouched.
There is no open issue for this. I found it in a Symfony API validating user-supplied
files, which arrive as
HttpFoundation\File\FileanSplFileInfosubclass.