Skip to content

[5.x] Fix param leak in AdminUrlGenerator::generateUrl - #7783

Open
ousamabenyounes wants to merge 1 commit into
EasyCorp:5.xfrom
ousamabenyounes:fix_7734
Open

[5.x] Fix param leak in AdminUrlGenerator::generateUrl#7783
ousamabenyounes wants to merge 1 commit into
EasyCorp:5.xfrom
ousamabenyounes:fix_7734

Conversation

@ousamabenyounes

Copy link
Copy Markdown
Q A
Branch? 5.x
Bug fix? yes
New feature? no
Deprecations? no
Issues Fix #7734
License MIT

AdminUrlGenerator::generateUrl() ends with a state reset whose own comment
states it is "important to start the generation of each URL from the same
initial state, otherwise some parameters used when generating some URL could
leak to other URLs"
. But three earlier return statements — the empty-route
dashboard link and both EA::ROUTE_NAME branches (the linkToRoute() path) —
returned before that reset ever ran.

As a result, once a URL was generated through the linkToRoute() path, the
generator stayed initialized with routeName/routeParams still set. The next
URL generated in the same request (e.g. a linkToCrudAction() global action)
re-entered the ROUTE_NAME branch and lost its filters/page/sort/query
parameters — even though every other link on the page kept them.

The fix moves the reset into a finally block so it runs on every return path
(and on exceptions), which is exactly the "same initial state" guarantee the
existing comment promised.

Test verification (RED → GREEN)

New test AdminUrlGeneratorTest::testRouteParametersDontLeakToNextUrl generates
a custom-route URL and then asserts the following URL is clean.

RED — on 5.x with only the test applied (before the fix):

1) EasyCorp\Bundle\EasyAdminBundle\Tests\Unit\Router\AdminUrlGeneratorTest::testRouteParametersDontLeakToNextUrl
Failed asserting that two strings are identical.
--- Expected
+++ Actual
@@ @@
-'http://localhost/admin?foo=bar'
+'http://localhost/admin?routeName=some_route&routeParams%5Bkey%5D=value'

FAILURES!
Tests: 1, Assertions: 1, Failures: 1.

GREEN — with the fix applied, whole test class:

Testing EasyCorp\Bundle\EasyAdminBundle\Tests\Unit\Router\AdminUrlGeneratorTest
..................                                                18 / 18 (100%)

OK (18 tests, 35 assertions)

phpstan analyse src/Router/AdminUrlGenerator.php and php-cs-fixer (dry-run)
both report no issues on the changed files.

@ousamabenyounes

Copy link
Copy Markdown
Author

Note on CI: the single red job phpunit (ubuntu-latest, 8.4, 8.0.*) is
unrelated to this change. It fails suite-wide (~400 errors) on functional
tests such as ImageFieldTest, which this PR doesn't touch. Running the
unmodified 5.x tip against symfony/*:8.0.* reproduces the same failures
(e.g. ImageFieldTest 8/8 failing with "actual size 0 matches expected
size 1"), so it looks like a Symfony 8.0 point-release compatibility break
in the test app rather than a regression here. This PR only touches
AdminUrlGenerator, whose unit test passes on every green matrix row.

Three early returns in generateUrl() skipped the state reset that only
the final return performed, so parameters from a custom-route URL (the
linkToRoute() path) leaked into the next URL generated in the same
request, dropping its filters/page/sort. Reset the state in a finally
block so every return path starts from the same initial state.

Fix EasyCorp#7734
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

AdminUrlGenerator loses filters/page/sort when generating a URL after a linkToRoute() action was generated in the same request

1 participant