-
-
Notifications
You must be signed in to change notification settings - Fork 9.6k
[Security] getTargetPath of TargetPathTrait must return string or null #29408
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
little test would be nice :)
The way tests are written adding a test does not add any value. If tests where using an actual session with a |
We can assert the default value is passed here
|
OR we should change the return type to |
for reference, same topic was somewhat discussed here: #23409 (comment) tend to like the empty string here as well (over null), as it's a valid relative target URI as well. So no hassle with null checks required. |
Personally I have banned |
what the code does is |
and the BC break argument is not a minor one! |
Let me elaborate: I have a class that I use this trait. If we go with the solution of
if we go just with the
Never said it is minor.. except if you were not referring to me.. But since you mention it the BC it depends I believe in the way that you look at this. If someone was depending on the docbloc then it is not a BC.. That is what the code should do and it is just a bug fix. If someone was depending on the actual implementation and he was actually checking about My point of view tends towards to the direction that it is a bug. The docblock says string. If someone was depending on null he should commit PR and never the less he should check against emtpy string as well. |
The docblock is just a hint - it doesn't enforce anything. |
Yea I know what you meant.. so let's not keep going in loops.. You said your PoV and I said mine.. In this specific case I believe there is no right or wrong so someone has to take a decision.
Judging by the above I feel that you are not certain either... and also the fact that @ro0NL posted an accepted PR doing otherwise. So I will need you (@nicolas-grekas) to give me the final direction. 😄 Also I need to know what about tests.. If this is limited to a docblock change then no test changes is required since there is no way to actually reproduce this in the way they are written. Too much mocking that it will just make it silly. I would be happy to refactor tests as well on this PR using an actual If we stay with the change as is in my thinking tests should be all about giving |
My vote is for changing the type hint. |
Thank you @gmponos. |
…string or null (gmponos) This PR was squashed before being merged into the 3.4 branch (closes #29408). Discussion ---------- [Security] getTargetPath of TargetPathTrait must return string or null | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes (possible bug) | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | License | MIT Since the return type is string the default return value must be also string. Commits ------- 8d4b787 [Security] getTargetPath of TargetPathTrait must return string or null
Since the return type is string the default return value must be also string.