I was surprised to not see anything in the documentation as far as whether or not wildcard routing parameters need to be sanitized before using them in the controller action method.

In Using parameters in routes, there doesn't seem to be any mention about whether or not the Symfony routing takes care of the sensitization or not unless I'm missing something.

This is my test.routing.yml file.

  path: '/test/hello/{name}'
    _controller: '\Drupal\test\Controller\TestController::doTest'
    _title: 'This is the page title - nothing more Yo'
    name: "Rumplestiltskin"
    _permission: 'access content'

It seems that others are having a question about this as well:

Obviously anything in the path could be altered by a user so you’ll want to test for valid values and otherwise ensure that these values are safe to use. I can’t tell if the system does any sanitization of these values or if this is a straight pass-through of whatever is in the url, so I’d probably assume that I need to type hint and sanitize these values as necessary for my code to work.

Based on some additional research it looks like they are not sanitized by default. See https://stackoverflow.com/questions/24880067/are-symfony-2-0-route-wildcards-sanitized.
This seems like it's ripe for a code injection attack via something like the following.

$res = eval('return 1 + '. $_GET['crazy']+ ';'); with ?crazy=0;exec("rm+-rf+/")

Can anyone confirm that we do need to sanitize and if so a recommendation for sanitizing string input in a standard way?


How to sanitize something depends on what you want to use it for.

It's entirely different if you want to protect against SQL injection in a database query or XSS when printing something.

PHP tried to do magic things on input but those features were removed a long time ago, see http://php.net/manual/en/security.magicquotes.whynot.php for example.

Protecting against SQL injecting is easy with the provided tools, Drupal 8 also autoescapes all output unless its told that something is safe. And simply don't use eval(), ever.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.