Input value "_method" contains a non-scalar value.

[tobz-nz]

Laravel Version

10.29.0

PHP Version

8.2.2

Database Driver & Version

No response

Description

One of my sites has been getting attacked today and one of the things they did is posted _method as an array to a form endpoint. Which throws an error(stack trace removed for security): https://flareapp.io/share/DPyKdV65

This is the relevant line:

// vendor/symfony/http-foundation/Request.php
1213     if (!$method && self::$httpMethodParameterOverride) {
1214            $method = $this->request->get('_method', $this->query->get('_method', 'POST'));
1215     }

Steps To Reproduce

In a new Laravel install (with Pest) make a test like:

it('validates _method', function () {
    $this->post('/', ['_method' => ['invalid']])
        ->assertInvalid('_method');
});

[crynobone]

It seems that the issue also exist in Symfony HTTP Foundation, might worth it to report the issue there.

[mbabker]

This is not a Symfony bug, but the API design decision.

Symfony\Component\HttpFoundation\InputBag was introduced for exactly this type of scenario (an array being stuffed into an input where a single value is expected), with its get() method only being allowed to return scalar values. Symfony is behaving as intended and explicitly forbidding an array value for the _method field in the input, throwing a Symfony\Component\HttpFoundation\Exception\BadRequestException (which should give the client a 400 response).

[driesvints]

Thanks @mbabker. Seems things work as expected here then. We'd appreciate a PR to avoid logging this specific exception!

[github-actions]

Thank you for reporting this issue!

As Laravel is an open source project, we rely on the community to help us diagnose and fix issues as it is not possible to research and fix every issue reported to us via GitHub.

If possible, please make a pull request fixing the issue you have described, along with corresponding tests. All pull requests are promptly reviewed by the Laravel team.

Thank you!

[driesvints]

We'd still appreciate a PR for this one, thanks.