Page MenuHomePhabricator

User Input can cause fatal error in ValidateFeeController
Closed, ResolvedPublic

Description

It appears like certain user input can cause PHP to throw a fatal error on FundraisingFrontend:

[07-Nov-2018 15:30:53 Europe/Berlin] PHP Fatal error:  Uncaught TypeError: Argument 1 passed to WMDE\Euro\Euro::__construct() must be of the type integer, float given, called in /usr/share/nginx/www/spenden.wikimedia.de/release-20181101181039/vendor/wmde/euro/src/Euro.php on line 62 and defined in /usr/share/nginx/www/spenden.wikimedia.de/release-20181101181039/vendor/wmde/euro/src/Euro.php:24
Stack trace:
#0 /usr/share/nginx/www/spenden.wikimedia.de/release-20181101181039/vendor/wmde/euro/src/Euro.php(62): WMDE\Euro\Euro->__construct(9.2233720368548E+20)
#1 /usr/share/nginx/www/spenden.wikimedia.de/release-20181101181039/app/Controllers/ValidateFeeController.php(50): WMDE\Euro\Euro::newFromString('111111111111111...')
#2 /usr/share/nginx/www/spenden.wikimedia.de/release-20181101181039/app/Controllers/ValidateFeeController.php(25): WMDE\Fundraising\Frontend\App\Controllers\ValidateFeeController->euroFromRequest(Object(Symfony\Component\HttpFoundation\Request))
#3 /usr/share/nginx/www/spenden.wikimedia.de/release-20181101181039/vendor/symfony/http-kernel/HttpKerne in /usr/share/nginx/www/spenden.wikimedia.de/release-20181101181039/vendor/wmde/euro/src/Euro.php on line 24

Taken from php-errors.log on production.

Note: This happened during the cat17 vs 10h16 skin test, it could be that the issue is somewhere in 10h16 but I have not looked into this at all at the time of writing this.

Event Timeline

Regardless if our frontend validation catches this or not - this is an oversight in our Euro class. It should check the string length or the data type after conversion. Also, we need to define the maximum amount the Euro class can handle. Probably PHP_INT_MAX since we're using integers internally. But since PHP_INT_MAX is platform-specifiy maybe we should come up with our own number that is maximally compatible.