Skip to content

Commit 722c816

Browse files
committed
feature symfony#26261 [Validator] Improvement: provide file basename for constr. violation messages in FileValidator. (TheCelavi)
This PR was squashed before being merged into the 4.2-dev branch (closes symfony#26261). Discussion ---------- [Validator] Improvement: provide file basename for constr. violation messages in FileValidator. | Q | A | ------------- | --- | Branch? | 3.4 <!-- see below --> | Bug fix? | no | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | no | License | MIT | Doc PR | N/A `\Symfony\Component\Validator\Constraints\FileValidator` provides absolute path to file on server when user, per example, uploads empty file, too large file, of wrong mime type, etc... Absolute path to file on server does not have value to the end user, on top of that, exposing it can be a security issue - end user should not be aware of server filesystem. Basename of file, however, has value (per example: MyAwesomeSheet.xlsx, MyCV.doc, etc..) - if something is wrong with file upload (size, mime, etc...). If basename is exposed, we can construct messages like: "Your file 'MyCV.doc' is not allowed for upload due to....whatever"... This PR provides basename of file so end user of `\Symfony\Component\Validator\Constraints\FileValidator` can construct error messages of higher value for end user. Commits ------- a77abad [Validator] Improvement: provide file basename for constr. violation messages in FileValidator.
2 parents d13141f + a77abad commit 722c816

File tree

2 files changed

+9
-0
lines changed

2 files changed

+9
-0
lines changed

src/Symfony/Component/Validator/Constraints/FileValidator.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,10 +138,12 @@ public function validate($value, Constraint $constraint)
138138
}
139139

140140
$sizeInBytes = filesize($path);
141+
$basename = $value instanceof UploadedFile ? $value->getClientOriginalName() : basename($path);
141142

142143
if (0 === $sizeInBytes) {
143144
$this->context->buildViolation($constraint->disallowEmptyMessage)
144145
->setParameter('{{ file }}', $this->formatValue($path))
146+
->setParameter('{{ name }}', $this->formatValue($basename))
145147
->setCode(File::EMPTY_ERROR)
146148
->addViolation();
147149

@@ -158,6 +160,7 @@ public function validate($value, Constraint $constraint)
158160
->setParameter('{{ size }}', $sizeAsString)
159161
->setParameter('{{ limit }}', $limitAsString)
160162
->setParameter('{{ suffix }}', $suffix)
163+
->setParameter('{{ name }}', $this->formatValue($basename))
161164
->setCode(File::TOO_LARGE_ERROR)
162165
->addViolation();
163166

@@ -189,6 +192,7 @@ public function validate($value, Constraint $constraint)
189192
->setParameter('{{ file }}', $this->formatValue($path))
190193
->setParameter('{{ type }}', $this->formatValue($mime))
191194
->setParameter('{{ types }}', $this->formatValues($mimeTypes))
195+
->setParameter('{{ name }}', $this->formatValue($basename))
192196
->setCode(File::INVALID_MIME_TYPE_ERROR)
193197
->addViolation();
194198
}

src/Symfony/Component/Validator/Tests/Constraints/FileValidatorTest.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,7 @@ public function testMaxSizeExceeded($bytesWritten, $limit, $sizeAsString, $limit
177177
->setParameter('{{ size }}', $sizeAsString)
178178
->setParameter('{{ suffix }}', $suffix)
179179
->setParameter('{{ file }}', '"'.$this->path.'"')
180+
->setParameter('{{ name }}', '"'.basename($this->path).'"')
180181
->setCode(File::TOO_LARGE_ERROR)
181182
->assertRaised();
182183
}
@@ -279,6 +280,7 @@ public function testBinaryFormat($bytesWritten, $limit, $binaryFormat, $sizeAsSt
279280
->setParameter('{{ size }}', $sizeAsString)
280281
->setParameter('{{ suffix }}', $suffix)
281282
->setParameter('{{ file }}', '"'.$this->path.'"')
283+
->setParameter('{{ name }}', '"'.basename($this->path).'"')
282284
->setCode(File::TOO_LARGE_ERROR)
283285
->assertRaised();
284286
}
@@ -357,6 +359,7 @@ public function testInvalidMimeType()
357359
->setParameter('{{ type }}', '"application/pdf"')
358360
->setParameter('{{ types }}', '"image/png", "image/jpg"')
359361
->setParameter('{{ file }}', '"'.$this->path.'"')
362+
->setParameter('{{ name }}', '"'.basename($this->path).'"')
360363
->setCode(File::INVALID_MIME_TYPE_ERROR)
361364
->assertRaised();
362365
}
@@ -387,6 +390,7 @@ public function testInvalidWildcardMimeType()
387390
->setParameter('{{ type }}', '"application/pdf"')
388391
->setParameter('{{ types }}', '"image/*", "image/jpg"')
389392
->setParameter('{{ file }}', '"'.$this->path.'"')
393+
->setParameter('{{ name }}', '"'.basename($this->path).'"')
390394
->setCode(File::INVALID_MIME_TYPE_ERROR)
391395
->assertRaised();
392396
}
@@ -403,6 +407,7 @@ public function testDisallowEmpty()
403407

404408
$this->buildViolation('myMessage')
405409
->setParameter('{{ file }}', '"'.$this->path.'"')
410+
->setParameter('{{ name }}', '"'.basename($this->path).'"')
406411
->setCode(File::EMPTY_ERROR)
407412
->assertRaised();
408413
}

0 commit comments

Comments
 (0)