Skip to content

Unknown "routeName" query parameter causes a 500 (RouteNotFoundException) instead of a 404 #7827

Description

@pfpro

Context
Our application has fully migrated to pretty URLs (#[AdminRoute]) and no longer generates legacy ?routeName= URLs itself. However, we can't rule out that end users still reach the dashboard through old legacy URLs (bookmarks, browser history, links in emails or documents). If such a URL contains a mistyped or since-removed route name, the user runs into a server error instead of a proper "not found" page.

Describe the bug
When a dashboard URL contains a routeName query parameter that does not match any existing route, EasyAdmin throws an uncaught Symfony\Component\Routing\Exception\RouteNotFoundException, resulting in a 500 Internal Server Error.

Since the value comes straight from the query string, this is a client error and should result in a 404 Not Found instead. A typo in a URL (or any bot/crawler probing URLs) currently produces a server error and a request.CRITICAL log entry.

To Reproduce

  1. Log in to any EasyAdmin dashboard
  2. Open the dashboard URL with a non-existent route name, e.g.
    /admin?routeName=this_route_does_not_exist
  3. See a 500 error:
    Symfony\Component\Routing\Exception\RouteNotFoundException:
    Unable to generate a URL for the named route "this_route_does_not_exist" as such route does not exist.
    

Expected behavior
A 404 response (NotFoundHttpException).

Cause
AdminRouterSubscriber::getSymfonyControllerFqcn() calls the URL generator without guarding against unknown route names:

private function getSymfonyControllerFqcn(Request $request): ?string
{
    $routeName = $request->query->get(EA::ROUTE_NAME);
    $routeParams = $request->query->all(EA::ROUTE_PARAMS);
    $url = $this->urlGenerator->generate($routeName, $routeParams, UrlGeneratorInterface::ABSOLUTE_PATH);
    // ...
}

Possible fix
Catch the exception and convert it into a 404:

try {
    $url = $this->urlGenerator->generate($routeName, $routeParams, UrlGeneratorInterface::ABSOLUTE_PATH);
} catch (RouteNotFoundException $e) {
    throw new NotFoundHttpException(sprintf('The route "%s" does not exist.', $routeName), $e);
}

The same probably applies to MissingMandatoryParametersException / InvalidParameterException when routeParams don't match the route requirements, which are also client-controlled.

Additional context

  • EasyAdmin: 5.6.0 (also present in the current 5.x branch)
  • Symfony: 8.1.7
  • PHP: 8.5.8

Activity

  1. added this to the 5.x milestone on Sep 28, 2026
  2. added a commit that references this issue on Oct 10, 2026
    e451db8
  3. added a commit that references this issue on Oct 10, 2026
    df52b8d
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions