Skip to content

Commit 506830a

Browse files
committed
minor #19960 [ExpressionLanguage] Remove misleading warning (valepu)
This PR was submitted for the 7.1 branch but it was merged into the 5.4 branch instead. Discussion ---------- [ExpressionLanguage] Remove misleading warning Fixes #17978 The warning I am removing was created after #8259 but the issue used an incorrect regex to show a potential problem which doesn't exist. In my issue I show that it's not actually possible to inject control characters. I would still suggest for someone more involved in symfony development to investigate further, if the expression language is used in the security component this would need more than just a warning <!-- If your pull request fixes a BUG, use the oldest maintained branch that contains the bug (see https://symfony.com/releases for the list of maintained branches). If your pull request documents a NEW FEATURE, use the same Symfony branch where the feature was introduced (and `7.x` for features of unreleased versions). --> Commits ------- e9d242d Remove misleading warning
2 parents ccaa7f8 + e9d242d commit 506830a

File tree

1 file changed

+0
-7
lines changed

1 file changed

+0
-7
lines changed

components/expression_language.rst

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -112,13 +112,6 @@ expressions (e.g. the request, the current user, etc.):
112112
* :doc:`Variables available in service container expressions </service_container/expression_language>`;
113113
* :ref:`Variables available in routing expressions <routing-matching-expressions>`.
114114

115-
.. caution::
116-
117-
When using variables in expressions, avoid passing untrusted data into the
118-
array of variables. If you can't avoid that, sanitize non-alphanumeric
119-
characters in untrusted data to prevent malicious users from injecting
120-
control characters and altering the expression.
121-
122115
.. _expression-language-caching:
123116

124117
Caching

0 commit comments

Comments
 (0)