I tripped over a peculiar behaviour involving the SensioFrameworkExtraBundle's DoctrineParamConverter, and now also Entity Argument Resolver in #43854.

In a common controller URL parameter conversion scenario, it goes like this:

1. If you have a route: #[Route('/test/{parentEntity<\d+>}/load/{childEntity<\d+>?})], and
2. If your controller has a signature of public function action(Parent $parentEntity, ?Child $childEntity), then
3. When you call /test/50/load/, the childEntity should be null, but instead it is whatever is the first member of the child collection in the parentEntity is.

The root cause of this is the piece of code I linked above:

if (null === $mapping = $options->mapping) {
    $keys = $request->attributes->keys();
    $mapping = $keys ? array_combine($keys, $keys) : [];
}

// ... 

$metadata = $objectManager->getClassMetadata($class); // Child entity metadata
foreach ($mapping as $attribute => $field) {
    if (!$metadata->hasField($field) && (!$metadata->hasAssociation($field) || !$metadata->isSingleValuedAssociation($field))) {
        continue;
    }

    $criteria[$field] = $request->attributes->get($attribute);
}

// ...

try {
    return $objectManager->getRepository($class)->findOneBy($criteria);
} catch (NoResultException|ConversionException) {
    return null;
}

1. The $mapping contains the current request attributes, so for instance, ['parentEntity' => 50, '_route' => '_route', ...].
2. Here is the problem: If the $child happens to have an association called parentEntity, the code above slaps ['parentEntity' => 50] to $criteria.
3. $criteria is later passed to findOneBy. Since the criteria only contains the parentEntity's ID, it will find one childEntity according to the $criteria - the first that belongs to the parent with ID 50. But we did not pass any childEntity ID - we did not want the converter to load anything

I think the original idea is not bad - the end effect is that if there are multiple related entities, they are guaranteed to belong together, because the $criteria contains more than just a single primary key. Even though it's magic that depends on consistent naming conventions, let's roll with it.

The problem I see is that if the childEntity value is not present in the $mapping array (= the value is missing in the Request), none of this code should have been executed in the first place.

This behaviour can be suppressed by providing the id param name in options, but I'm wondering if this should not be the default for optional parameters?