security fix

laravel · Jun 14, 2021 · 634017d · 634017d
1 parent c50087d
commit 634017d
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 1 deletion.
diff --git a/src/Illuminate/Validation/Rules/RequiredIf.php b/src/Illuminate/Validation/Rules/RequiredIf.php
@@ -19,7 +19,11 @@ class RequiredIf
      */
     public function __construct($condition)
     {
-        $this->condition = $condition;
+        if(!is_string($condition) && (is_bool($condition) || is_callable($condition))) {
+            $this->condition = $condition;
+        } else {
+            throw new InvalidArgumentException("Condition type must be 'callable' or 'bool'.");
+        }
     }
 
     /**

diff --git a/tests/Validation/ValidationRequiredIfTest.php b/tests/Validation/ValidationRequiredIfTest.php
@@ -29,4 +29,30 @@ public function testItClousureReturnsFormatsAStringVersionOfTheRule()
 
         $this->assertSame('', (string) $rule);
     }
+
+    public function testItOnlyCallableAndBooleanAreAcceptableArgumentsOfTheRule()
+    {
+        $rule = new RequiredIf(false);
+
+        $rule = new RequiredIf(true);
+
+        $this->expectException(InvalidArgumentException::class);
+
+        $rule = new RequiredIf('phpinfo');
+
+        $rule = new RequiredIf(12.3);
+
+        $rule = new RequiredIf(new stdClass());
+    }
+
+    public function testItReturnedRuleIsNotSerializable()
+    {
+        $this->expectException(Exception::class);
+
+        $rule = serialize(new RequiredIf(function () {
+            return true;
+        }));
+
+        $rule = serialize(new RequiredIf());
+    }
 }