[Bug]: Verify Email Address

[MadZee-M]

Laravel Version

12.13

PHP Version

8.3

Database Driver & Version

No response

Description

Steps To Reproduce

1. Register
2. Receive a link by email: http://domain/email/verify//?expires=&signature=
3. Copy the link and create a signature array: http://domain/email/verify//?expires=&signature**[]**=
4. We get an error.

Error in file: **/Illuminate/Routing/UrlGenerator.php** method **hasCorrectSignature()**

[crynobone]

The error does make sense, in production that will be converted 500 error

[iBotPeaches]

It is a bit annoying though. I recognize this stacktrace from audits that we have to argue against some automated scanner that fired some garbage at an endpoint and triggered a 500.

I remember this same array/string issue in the past except for user-agent on the sessions table. I could see this being handled in framework as clearly an array is not going to hash properly and should be treated as a failure.

[macropay-solutions]

We used to handle these cases with filter_var($x, FILTER_SANITIZE_STRING) but now they deprecated it.
https://stackoverflow.com/questions/69207368/constant-filter-sanitize-string-is-deprecated
filter_var([], FILTER_UNSAFE_RAW)); can be used instead and will return false for arrays, that casted to string is empty string.

We were surprised to see laravel does not have filters for the request (phalcon php has these kind of filters/sanitizers that you can use just like you use the validators in laravel with the difference that they will not throw but return false or empty string or null).

[macropay-solutions]

Good news is that Symfony ParameterBag has these kind of filters:

[macropay-solutions]

$request->query->getAlnum('signature', '') could be used or $request->query->filter('signature', '') for any string character.

[macropay-solutions]

Thanks for the idea: https://github.com/macropay-solutions/laravel-crud-wizard-free/blob/42df41aa33ad19011013e3241df8f65f05348a08/src/Providers/CrudProvider.php#L74