Skip to content

Commit 225c38c

Browse files
authored
Remove misleading warning
Fixes #17978 The warning I am removing was created after #8259 but the issue used an incorrect regex to show a potential problem which doesn't exist. In my issue I show that it's not actually possible to inject control characters. I would still suggest for someone more involved in symfony development to investigate further, if the expression language is used in the security component this would need more than just a warning
1 parent 9bfc9fa commit 225c38c

File tree

1 file changed

+0
-7
lines changed

1 file changed

+0
-7
lines changed

components/expression_language.rst

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -161,13 +161,6 @@ expressions (e.g. the request, the current user, etc.):
161161
* :doc:`Variables available in service container expressions </service_container/expression_language>`;
162162
* :ref:`Variables available in routing expressions <routing-matching-expressions>`.
163163

164-
.. caution::
165-
166-
When using variables in expressions, avoid passing untrusted data into the
167-
array of variables. If you can't avoid that, sanitize non-alphanumeric
168-
characters in untrusted data to prevent malicious users from injecting
169-
control characters and altering the expression.
170-
171164
.. _expression-language-caching:
172165

173166
Caching

0 commit comments

Comments
 (0)