Skip to content

fix: resolve method parameter injection for hyphenated request param names#108

Merged
usernane merged 2 commits intomainfrom
dev
May 5, 2026
Merged

fix: resolve method parameter injection for hyphenated request param names#108
usernane merged 2 commits intomainfrom
dev

Conversation

@usernane
Copy link
Copy Markdown
Member

@usernane usernane commented May 5, 2026

Summary

Fix positional matching of #[RequestParam] attributes to method parameters and fix associative array serialization in JSON responses.

Motivation

Method parameter injection fails when request parameter names are hyphenated (e.g., app-id) because the framework looked up values using the PHP variable name instead of the registered parameter name. Fixes #106.

Changes

  • Updated WebService::getMethodParameters() to use positional matching: the Nth #[RequestParam] attribute name is used to resolve the Nth method parameter
  • Fixed handleMethodResponse() to serialize associative arrays as JSON objects (preserving keys) using array_is_list() check
  • Added HyphenatedParamService test service and HyphenatedParamInjectionTest with 4 test cases

How to Test / Verify

Unit tests: phpunit --filter HyphenatedParamInjectionTest — all 4 tests pass. Full suite (435 tests) passes with no regressions.

Breaking Changes and Migration Steps

None. Existing services with matching variable names continue to work via the fallback path.

Checklist

  • I reviewed my own diff before requesting review
  • My commits follow Conventional Commits
  • The title of the pull request follows Conventional Commits
  • I added/updated tests (or explained why not)
  • I updated docs (if needed)
  • I ran lint/cs-fixer (if applicable)
  • I considered backward compatibility
  • I considered security

Related issues

Closes #106

…names

Use positional matching of #[RequestParam] attributes to method parameters
instead of relying on PHP variable names. The Nth attribute's name is used
to look up the value for the Nth method parameter.

Also fix associative array serialization in handleMethodResponse() to
preserve string keys by passing them as JSON objects instead of arrays.

Closes #106
@codecov
Copy link
Copy Markdown

codecov Bot commented May 5, 2026

Codecov Report

❌ Patch coverage is 87.50000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.34%. Comparing base (442f336) to head (09162ce).
⚠️ Report is 5 commits behind head on main.

Files with missing lines Patch % Lines
WebFiori/Http/WebService.php 87.50% 3 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##               main     #108      +/-   ##
============================================
+ Coverage     92.32%   92.34%   +0.01%     
- Complexity     1292     1302      +10     
============================================
  Files            39       39              
  Lines          3128     3147      +19     
============================================
+ Hits           2888     2906      +18     
- Misses          240      241       +1     
Flag Coverage Δ
php-8.1 92.11% <87.50%> (+0.01%) ⬆️
php-8.2 92.18% <87.50%> (+0.01%) ⬆️
php-8.3 92.18% <87.50%> (+0.01%) ⬆️
php-8.4 92.18% <87.50%> (+0.01%) ⬆️
php-8.5 92.18% <87.50%> (+0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

…esponseBody]

Introduce ResponseEntity that wraps body, status code, and content type,
allowing methods to return different HTTP status codes based on runtime logic.

Includes static factory methods: ok(), created(), noContent(), badRequest(),
unauthorized(), forbidden(), notFound(), error().

When handleMethodResponse() detects a ResponseEntity return value, it uses
its status and content type instead of the annotation defaults.

Closes #107
@usernane usernane merged commit 18b9edd into main May 5, 2026
6 checks passed
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented May 5, 2026

Quality Gate Failed Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug: Method parameter injection fails for hyphenated request param names

1 participant