symfony · chalasr · Nov 30, 2022 · Nov 23, 2022 · chalasr · Nov 27, 2022
@@ -97,8 +97,12 @@ public function consumeLoginLink(Request $request): UserInterface
            throw new InvalidLoginLinkException('User not found.', 0, $exception);
        }

-        $hash = $request->get('hash');
-        $expires = $request->get('expires');
+        if (!$hash = $request->get('hash')) {
+            throw new InvalidLoginLinkException('Missing "hash" parameter.');
+        }
+        if (!$expires = $request->get('expires')) {
+            throw new InvalidLoginLinkException('Missing "expires" parameter.');
 throw new BadRequestHttpException(sprintf('The key "%s" must be a string.', $this->options['password_path'])); 
      * Throw InvalidLoginLinkExceptionInterface if the link is invalid. 
      */ 
     public function consumeLoginLink(Request $request): UserInterface; 
 throw new BadRequestHttpException(sprintf('The key "%s" must be a string.', $this->options['password_path'])); 
      * Throw InvalidLoginLinkExceptionInterface if the link is invalid. 
      */ 
     public function consumeLoginLink(Request $request): UserInterface; 
+        }

        try {
            $this->signatureHasher->verifySignatureHash($user, $expires, $hash);

@@ -182,6 +182,30 @@ public function testConsumeLoginLinkExceedsMaxUsage()
        $linker->consumeLoginLink($request);
    }

+    public function testConsumeLoginLinkWithMissingHash()
+    {
+        $user = new TestLoginLinkHandlerUser('weaverryan', 'ryan@symfonycasts.com', 'pwhash');
+        $this->userProvider->createUser($user);
+
+        $this->expectException(InvalidLoginLinkException::class);
+        $request = Request::create('/login/verify?user=weaverryan&expires=10000');
+
+        $linker = $this->createLinker();
+        $linker->consumeLoginLink($request);
+    }
+
+    public function testConsumeLoginLinkWithMissingExpiration()
+    {
+        $user = new TestLoginLinkHandlerUser('weaverryan', 'ryan@symfonycasts.com', 'pwhash');
+        $this->userProvider->createUser($user);
+
+        $this->expectException(InvalidLoginLinkException::class);
+        $request = Request::create('/login/verify?user=weaverryan&hash=thehash');
+
+        $linker = $this->createLinker();
+        $linker->consumeLoginLink($request);
+    }
+
    private function createSignatureHash(string $username, int $expires, array $extraFields): string
    {
        $fields = [base64_encode($username), $expires];