Skip to content

Bug: APIFilter::applyBasicFilterOnly destroys native PHP false before boolean check #132

@usernane

Description

@usernane

Description

When a ParamType::BOOL parameter receives a native PHP false value (e.g., from $_POST set directly in tests), the applyBasicFilterOnly method calls strip_tags($toBeFiltered) before checking the type. Since strip_tags(false) casts false to an empty string "", the subsequent filterBoolean("") call fails to match any known boolean value and returns self::INVALID.

Steps to Reproduce

  1. Define an API parameter with ParamType::BOOL
  2. Pass native PHP false as the parameter value (e.g., $_POST["param"] = false)
  3. The parameter is reported as invalid

Root Cause

In APIFilter.php line ~347:

private static function applyBasicFilterOnly($def, $toBeFiltered) {
    if (gettype($toBeFiltered) == 'array') {
        return $toBeFiltered;
    }
    $toBeFiltered = strip_tags($toBeFiltered);  // <-- false becomes ""
    // ...
    if ($paramType == ParamType::BOOL) {
        $returnVal = self::filterBoolean($toBeFiltered);  // filterBoolean("") fails
    }
}

The filterBoolean method correctly handles native booleans:

private static function filterBoolean($boolean) {
    if (gettype($boolean) == 'boolean') {
        return $boolean;  // <-- never reached because strip_tags already converted it
    }
    // ...
}

Expected Behavior

Native PHP false should be accepted as a valid boolean parameter value.

Suggested Fix

Check for boolean type before calling strip_tags:

private static function applyBasicFilterOnly($def, $toBeFiltered) {
    if (gettype($toBeFiltered) == 'array') {
        return $toBeFiltered;
    }
    if (gettype($toBeFiltered) == 'boolean') {
        return $toBeFiltered;
    }
    $toBeFiltered = strip_tags($toBeFiltered);
    // ...
}

Environment

  • webfiori/http version: installed via webfiori/framework v3.0.0-RC.4
  • PHP 8.4

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions