Do path parameters need to be sanitized before using in the controller action method?

Question

I was surprised to not see anything in the documentation as far as whether or not wildcard routing parameters need to be sanitized before using them in the controller action method.

In Using parameters in routes, there doesn't seem to be any mention about whether or not the Symfony routing takes care of the sensitization or not unless I'm missing something.

This is my test.routing.yml file.

test.test_controller_doTest:
  path: '/test/hello/{name}'
  defaults:
    _controller: '\Drupal\test\Controller\TestController::doTest'
    _title: 'This is the page title - nothing more Yo'
    name: "Rumplestiltskin"
  requirements:
    _permission: 'access content'

It seems that others are having a question about this as well:

Obviously anything in the path could be altered by a user so you’ll want to test for valid values and otherwise ensure that these values are safe to use. I can’t tell if the system does any sanitization of these values or if this is a straight pass-through of whatever is in the url, so I’d probably assume that I need to type hint and sanitize these values as necessary for my code to work.

Based on some additional research it looks like they are not sanitized by default. See https://stackoverflow.com/questions/24880067/are-symfony-2-0-route-wildcards-sanitized.
This seems like it's ripe for a code injection attack via something like the following.

$res = eval('return 1 + '. $_GET['crazy']+ ';'); with ?crazy=0;exec("rm+-rf+/")

Can anyone confirm that we do need to sanitize and if so a recommendation for sanitizing string input in a standard way?

Answer 1

How to sanitize something depends on what you want to use it for.

It's entirely different if you want to protect against SQL injection in a database query or XSS when printing something.

PHP tried to do magic things on input but those features were removed a long time ago, see http://php.net/manual/en/security.magicquotes.whynot.php for example.

Protecting against SQL injecting is easy with the provided tools, Drupal 8 also autoescapes all output unless its told that something is safe. And simply don't use eval(), ever.

Answer 2

Well, actually according to Drupal official docs you can specify validation criteria on *.routing.yml level file. The only thing to do is to add another section/sections on requirements property. Here's the example of filtering parameter {name} to allow to use only lower and upper characters from [a-z] and [A-Z]:

example.user
  path: '/example/{name}'
  defaults:
    _controller: '\Drupal\example\Controller\ExampleController::content'
  requirements:
    _permission: 'access content'
    name: '[a-z]+'

If you have more than just one parameter, include it in next line, like so:

example.user
  path: '/example/{name}/{surname}'
  defaults:
    _controller: '\Drupal\example\Controller\ExampleController::content'
  requirements:
    _permission: 'access content'
    name: '[a-zA-Z]+'
    surname: '[a-zA-Z]+'