Skip to content

fix(doctrine): ignore unresolved IRIs in ORM IriFilter - #8839

Closed
pysocrates wants to merge 8 commits into
api-platform:5.0from
pysocrates:fix/invalid-iri-filter
Closed

pysocrates wants to merge 8 commits into
api-platform:5.0from
pysocrates:fix/invalid-iri-filter

Conversation

@pysocrates

@pysocrates pysocrates commented Nov 11, 2026 •

Copy link
Copy Markdown

Problem

An invalid IRI can be swallowed by IriConverterParameterProvider, leaving an unresolved string for IriFilter and causing a server error.

Change

Add the optional throw_invalid_argument parameter extra property. When enabled, invalid IRI exceptions are propagated for both scalar and array parameters, allowing the default Symfony exception mapping to return HTTP 400. Existing behavior remains unchanged by default; the existing throw_not_found option continues to handle missing resources.

The Laravel development dependency constraint also allows MCP bundle 0.15, which resolves the Composer security-advisory blocker affecting the Laravel and PHPStan CI jobs on the base branch.

Fixes #8834

Validation

  • Provider regression tests for scalar and array values, including the default behavior.
  • Functional tests verify HTTP 400 for scalar and array invalid IRIs.
  • PHP CS Fixer dry run on changed PHP files.

Documentation: api-platform/docs#2369

Existing upstream CI failures

The Symfony 8.1 and Symfony dev jobs fail in PatchTest::testPatchRelation because a nested PATCH creates a new related entity rather than updating the existing one. The same failure occurs on the unmodified 5.0 base branch: https://github.com/api-platform/core/actions/runs/42815677460/job/129828038883

A separate fix for this regression is already open: #8825

@pysocrates
pysocrates marked this pull request as draft November 11, 2026 21:44
@pysocrates
pysocrates marked this pull request as ready for review November 11, 2026 21:57
@soyuka

soyuka commented Nov 12, 2026

Copy link
Copy Markdown
Member

Thanks! I reworked this a bit: filters don't throw on wrong values by default, they're ignored (validation is the way to go if you want a 400), so instead of a new throw_invalid_argument option the ORM IriFilter now does the same as the ODM one: an IRI that doesn't resolve gives no results instead of a 500. I also removed the symfony/mcp-bundle bump, it's handled in #8837.

@soyuka soyuka changed the title fix(state): allow invalid IRI exceptions to propagate fix(doctrine): ignore unresolved IRIs in ORM IriFilter Nov 12, 2026
@soyuka

soyuka commented Nov 13, 2026

Copy link
Copy Markdown
Member

Thanks @pysocrates! We took this over in #8844: the root cause is in IriConverterParameterProvider, which swallowed the conversion error without setting a value (and stopped at the first invalid IRI in a list), so we fixed it there instead of in each filter. You're credited as co-author on the commits.

@soyuka soyuka closed this Nov 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants