FormRequest::validated() returns all params in nested params.

[ttsuru]

• Laravel Version: 5.6.27

Description:

FormRequest::validated() returns only validated params method.
But all nested values ​​will be returned.
If validated method returns not validated values, this cause security probrem.

Steps To Reproduce:

FormRequest

<?php

namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;

class AdminRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
    public function authorize()
    {
        return true;
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array
     */
    public function rules()
    {
        return [
            'foo' => 'required',
            'bar' => 'required',
            'user.name' => 'required|max:255',
            'user.email' => 'required|max:255|email',
        ];
    }
}

In Controller

<?php

namespace App\Http\Controllers;

use App\Admin;
use App\Http\Requests\AdminRequest;
use App\Http\Resources\AdminResource;
use Illuminate\Contracts\Support\Responsable;

class AdminController extends Controller
{
    /**
     * Store a newly created resource in storage.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return \Illuminate\Http\Response|Responsable
     */
    public function store(AdminRequest $request)
    {
        var_dump($request->validated());
    }

Request data

array (size=3)
  'foo' => string 'foo' (length=3)
  'bar' => string 'bar' (length=3)
  'user' => 
    array (size=5)
      'id' => int 1
      'name' => string 'name' (length=4)
      'email' => string 'bar@example.org' (length=15)
      'created_at' => string '2001-01-01 00:00:00' (length=19)
      'updated_at' => string '2001-01-01 00:00:00' (length=19)

Return data

array (size=3)
  'foo' => string 'foo' (length=3)
  'bar' => string 'bar' (length=3)
  'user' => 
    array (size=5)
      'id' => int 1
      'name' => string 'name' (length=4)
      'email' => string 'bar@example.org' (length=15)
      'created_at' => string '2001-01-01 00:00:00' (length=19)
      'updated_at' => string '2001-01-01 00:00:00' (length=19)

Expected data

array (size=3)
  'foo' => string 'foo' (length=3)
  'bar' => string 'bar' (length=3)
  'user' => 
    array (size=2)
      'name' => string 'name' (length=4)
      'email' => string 'bar@example.org' (length=15)

[X-Coder264]

This has already been fixed for 5.7 -> #23708

Since this is a breaking change, it couldn't be merged into 5.6.

[ttsuru]

@X-Coder264

Thanks for your reply.
But I found this pull request probrem. So comment that ticket.