fix(dispatcher): surface preg_match() engine failures instead of treating them as no-match
All dispatcher strategies checked preg_match() results with `!== 1`, which conflates a genuine no-match (0) with a PCRE engine failure (false), e.g. PREG_BACKTRACK_LIMIT_ERROR from a catastrophically backtracking route pattern. Because dynamic routes for the same method are combined into shared regex chunks, one such route could make the preg_match() call for the whole chunk fail, silently turning an unrelated, cheap route in that chunk into a spurious NOT_FOUND. Add a shared matchRoute() helper on RegexBasedAbstract that calls preg_match() and throws a RuntimeException (including preg_last_error_msg()) when it returns false, while preserving the existing 0/1 no-match/match behavior. Update GroupCountBased, GroupPosBased, CharCountBased and MarkBased to use it. Fixes #167
This commit is contained in:
1 parent
5861a25d71
commit
dea7d75d42
6 files changed
+73
-9
No files matched your search
@@ -13,8 +13,11 @@ use FastRoute\Dispatcher\Result\MethodNotAllowed;
|
||||
use FastRoute\Dispatcher\Result\NotMatched;
|
||||
use PHPUnit\Framework\Attributes as PHPUnit;
|
||||
use PHPUnit\Framework\TestCase;
|
||||
use RuntimeException;
|
||||
|
||||
use function FastRoute\simpleDispatcher;
|
||||
use function ini_set;
|
||||
use function str_repeat;
|
||||
|
||||
/** @phpstan-import-type ExtraParameters from DataGenerator */
|
||||
abstract class DispatcherTestCase extends TestCase
|
||||
@@ -177,6 +180,40 @@ abstract class DispatcherTestCase extends TestCase
|
||||
}, $this->generateDispatcherOptions());
|
||||
}
|
||||
|
||||
/**
|
||||
* A PCRE engine failure (e.g. PREG_BACKTRACK_LIMIT_ERROR triggered by a
|
||||
* catastrophically backtracking route pattern) must not be silently
|
||||
* treated as "no match". Otherwise, an unrelated, cheap route that
|
||||
* happens to share the same combined regex chunk would spuriously
|
||||
* receive a NOT_FOUND result instead of surfacing the engine error.
|
||||
*
|
||||
* @see https://github.com/nikic/FastRoute/issues/167
|
||||
*/
|
||||
#[PHPUnit\Test]
|
||||
public function regexEngineFailureIsNotSilentlyTreatedAsNotFound(): void
|
||||
{
|
||||
$previousLimit = ini_set('pcre.backtrack_limit', '1000');
|
||||
self::assertNotFalse($previousLimit, 'Unable to lower pcre.backtrack_limit for this test');
|
||||
|
||||
try {
|
||||
$this->expectException(RuntimeException::class);
|
||||
$this->expectExceptionMessageMatches('/Backtrack limit exhausted/');
|
||||
|
||||
$dispatcher = simpleDispatcher(static function (ConfigureRoutes $r): void {
|
||||
// Catastrophically backtracking pattern.
|
||||
$r->addRoute('GET', '/{p:(?:a?a?)*}/complicated', 'complicated_pattern');
|
||||
// Cheap, unrelated route combined into the same regex chunk
|
||||
// as the pattern above. It would match the request URI on
|
||||
// its own, but the shared chunk's preg_match() call fails.
|
||||
$r->addRoute('GET', '/{p:a+}', 'cheap_route');
|
||||
}, $this->generateDispatcherOptions());
|
||||
|
||||
$dispatcher->dispatch('GET', '/' . str_repeat('a', 30));
|
||||
} finally {
|
||||
ini_set('pcre.backtrack_limit', $previousLimit);
|
||||
}
|
||||
}
|
||||
|
||||
/** @return iterable<string, array{0: string, 1: string, 2: Closure(ConfigureRoutes):void, 3: string, 4?: array<string, string>}> */
|
||||
public static function provideFoundDispatchCases(): iterable
|
||||
{
|
||||
|
||||
Reference in new issue
Block a user