[5.x] Fix param leak in AdminUrlGenerator::generateUrl - #7783
Open
ousamabenyounes wants to merge 1 commit into
Open
[5.x] Fix param leak in AdminUrlGenerator::generateUrl#7783ousamabenyounes wants to merge 1 commit into
ousamabenyounes wants to merge 1 commit into
Conversation
Author
|
Note on CI: the single red job |
Three early returns in generateUrl() skipped the state reset that only the final return performed, so parameters from a custom-route URL (the linkToRoute() path) leaked into the next URL generated in the same request, dropping its filters/page/sort. Reset the state in a finally block so every return path starts from the same initial state. Fix EasyCorp#7734
ousamabenyounes
force-pushed
the
fix_7734
branch
from
August 16, 2026 16:51
3aa93cd to
e3ce32e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AdminUrlGenerator::generateUrl()ends with a state reset whose own commentstates it is "important to start the generation of each URL from the same
initial state, otherwise some parameters used when generating some URL could
leak to other URLs". But three earlier
returnstatements — the empty-routedashboard link and both
EA::ROUTE_NAMEbranches (thelinkToRoute()path) —returned before that reset ever ran.
As a result, once a URL was generated through the
linkToRoute()path, thegenerator stayed initialized with
routeName/routeParamsstill set. The nextURL generated in the same request (e.g. a
linkToCrudAction()global action)re-entered the
ROUTE_NAMEbranch and lost itsfilters/page/sort/queryparameters — even though every other link on the page kept them.
The fix moves the reset into a
finallyblock so it runs on every return path(and on exceptions), which is exactly the "same initial state" guarantee the
existing comment promised.
Test verification (RED → GREEN)
New test
AdminUrlGeneratorTest::testRouteParametersDontLeakToNextUrlgeneratesa custom-route URL and then asserts the following URL is clean.
RED — on
5.xwith only the test applied (before the fix):GREEN — with the fix applied, whole test class:
phpstan analyse src/Router/AdminUrlGenerator.phpandphp-cs-fixer(dry-run)both report no issues on the changed files.