Context
Our application has fully migrated to pretty URLs (#[AdminRoute]) and no longer generates legacy ?routeName= URLs itself. However, we can't rule out that end users still reach the dashboard through old legacy URLs (bookmarks, browser history, links in emails or documents). If such a URL contains a mistyped or since-removed route name, the user runs into a server error instead of a proper "not found" page.
Describe the bug
When a dashboard URL contains a routeName query parameter that does not match any existing route, EasyAdmin throws an uncaught Symfony\Component\Routing\Exception\RouteNotFoundException, resulting in a 500 Internal Server Error.
Since the value comes straight from the query string, this is a client error and should result in a 404 Not Found instead. A typo in a URL (or any bot/crawler probing URLs) currently produces a server error and a request.CRITICAL log entry.
To Reproduce
- Log in to any EasyAdmin dashboard
- Open the dashboard URL with a non-existent route name, e.g.
/admin?routeName=this_route_does_not_exist
- See a 500 error:
Symfony\Component\Routing\Exception\RouteNotFoundException:
Unable to generate a URL for the named route "this_route_does_not_exist" as such route does not exist.
Expected behavior
A 404 response (NotFoundHttpException).
Cause
AdminRouterSubscriber::getSymfonyControllerFqcn() calls the URL generator without guarding against unknown route names:
private function getSymfonyControllerFqcn(Request $request): ?string
{
$routeName = $request->query->get(EA::ROUTE_NAME);
$routeParams = $request->query->all(EA::ROUTE_PARAMS);
$url = $this->urlGenerator->generate($routeName, $routeParams, UrlGeneratorInterface::ABSOLUTE_PATH);
// ...
}
Possible fix
Catch the exception and convert it into a 404:
try {
$url = $this->urlGenerator->generate($routeName, $routeParams, UrlGeneratorInterface::ABSOLUTE_PATH);
} catch (RouteNotFoundException $e) {
throw new NotFoundHttpException(sprintf('The route "%s" does not exist.', $routeName), $e);
}
The same probably applies to MissingMandatoryParametersException / InvalidParameterException when routeParams don't match the route requirements, which are also client-controlled.
Additional context
- EasyAdmin: 5.6.0 (also present in the current
5.x branch)
- Symfony: 8.1.7
- PHP: 8.5.8
Context
Our application has fully migrated to pretty URLs (
#[AdminRoute]) and no longer generates legacy?routeName=URLs itself. However, we can't rule out that end users still reach the dashboard through old legacy URLs (bookmarks, browser history, links in emails or documents). If such a URL contains a mistyped or since-removed route name, the user runs into a server error instead of a proper "not found" page.Describe the bug
When a dashboard URL contains a
routeNamequery parameter that does not match any existing route, EasyAdmin throws an uncaughtSymfony\Component\Routing\Exception\RouteNotFoundException, resulting in a 500 Internal Server Error.Since the value comes straight from the query string, this is a client error and should result in a 404 Not Found instead. A typo in a URL (or any bot/crawler probing URLs) currently produces a server error and a
request.CRITICALlog entry.To Reproduce
/admin?routeName=this_route_does_not_existExpected behavior
A 404 response (
NotFoundHttpException).Cause
AdminRouterSubscriber::getSymfonyControllerFqcn()calls the URL generator without guarding against unknown route names:Possible fix
Catch the exception and convert it into a 404:
The same probably applies to
MissingMandatoryParametersException/InvalidParameterExceptionwhenrouteParamsdon't match the route requirements, which are also client-controlled.Additional context
5.xbranch)