From 319763e48605877e52a7a32a5093bbdb7944b8c2 Mon Sep 17 00:00:00 2001 From: Kamil Tekiela Date: Mon, 11 Nov 2024 21:40:32 +0000 Subject: [PATCH] Don't use exceptions for flow control Signed-off-by: Kamil Tekiela --- .../Middleware/RequestProblemChecking.php | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/src/Http/Middleware/RequestProblemChecking.php b/src/Http/Middleware/RequestProblemChecking.php index 3a7a6a5d1b..50595fa4b5 100644 --- a/src/Http/Middleware/RequestProblemChecking.php +++ b/src/Http/Middleware/RequestProblemChecking.php @@ -11,7 +11,6 @@ use Psr\Http\Message\ResponseInterface; use Psr\Http\Message\ServerRequestInterface; use Psr\Http\Server\MiddlewareInterface; use Psr\Http\Server\RequestHandlerInterface; -use RuntimeException; use function __; use function count; @@ -27,23 +26,24 @@ final class RequestProblemChecking implements MiddlewareInterface public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface { - try { - if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])) { - throw new RuntimeException(__('GLOBALS overwrite attempt')); - } - - /** - * protect against possible exploits - there is no need to have so many variables - */ - if (count($_REQUEST) >= 1000) { - throw new RuntimeException(__('possible exploit')); - } - } catch (RuntimeException $exception) { + if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])) { $response = $this->responseFactory->createResponse(StatusCodeInterface::STATUS_INTERNAL_SERVER_ERROR); return $response->write($this->template->render('error/generic', [ 'lang' => $GLOBALS['lang'] ?? 'en', - 'error_message' => $exception->getMessage(), + 'error_message' => __('GLOBALS overwrite attempt'), + ])); + } + + /** + * protect against possible exploits - there is no need to have so many variables + */ + if (count($_REQUEST) >= 1000) { + $response = $this->responseFactory->createResponse(StatusCodeInterface::STATUS_INTERNAL_SERVER_ERROR); + + return $response->write($this->template->render('error/generic', [ + 'lang' => $GLOBALS['lang'] ?? 'en', + 'error_message' => __('possible exploit'), ])); }