<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="&quot;name&quot;: &quot;doctrine/orm&quot;,
&quot;version&quot;: &quot;v2.4.8&quot;,
&quot;source&quot;: {
    &quot;type&quot;: &quot;git&quot;,
    &quot;url&quot;: &quot;https://github.com/doctrine/doctrine2.git&quot;,
    &quot;reference&quot;: &quot;464b5fdbfbbeb4a65465ac173c4c5d90960f41ff&quot;
}"><pre class="notranslate"><code class="notranslate">"name": "doctrine/orm",
"version": "v2.4.8",
"source": {
    "type": "git",
    "url": "https://github.com/doctrine/doctrine2.git",
    "reference": "464b5fdbfbbeb4a65465ac173c4c5d90960f41ff"
}
</code></pre></div>
<p dir="auto">When the doctrine/ORM bundle is downloaded by composer (URL: <a href="https://api.github.com/repos/doctrine/doctrine2/zipball/464b5fdbfbbeb4a65465ac173c4c5d90960f41ff">https://api.github.com/repos/doctrine/doctrine2/zipball/464b5fdbfbbeb4a65465ac173c4c5d90960f41ff</a>) always the default=last version is returned. I don't know if other references are faulty, too.</p>
<table role="table">
<thead>
<tr>
<th>Q</th>
<th>A</th>
</tr>
</thead>
<tbody>
<tr>
<td>Bug report?</td>
<td>yes</td>
</tr>
<tr>
<td>Feature request?</td>
<td>no</td>
</tr>
<tr>
<td>BC Break report?</td>
<td>no</td>
</tr>
</tbody>
</table>
<p dir="auto">Hello the community,</p>
<p dir="auto">A hunter from our Bug Bounty Program reported that when an input is manually changed from text to an array on the form payload, he receives a 500 instead of a proper violation.</p>
<p dir="auto">For example, if <code class="notranslate">email=bob@lamouche.com</code> is changed to <code class="notranslate">email[]=bob@lamouche.com</code> on an email field having an EmailValidator, we end up with <a href="https://github.com/symfony/symfony/blob/master/src/Symfony/Component/Validator/Constraints/EmailValidator.php#L50">this exception thrown</a>:</p>
<p dir="auto"></p><div class="Box Box--condensed my-2">
  <div class="Box-header f6">
    <p class="mb-0 text-bold">
      <a href="https://github.com/symfony/symfony/blob/3e4f97852ddb17b740daaefa6b6df33d462ade59/src/Symfony/Component/Validator/Constraints/EmailValidator.php#L49-L51">symfony/src/Symfony/Component/Validator/Constraints/EmailValidator.php</a>
    </p>
    <p class="mb-0 color-fg-muted">
        Lines 49 to 51
      in
      <a data-pjax="true" class="commit-tease-sha" href="/symfony/symfony/commit/3e4f97852ddb17b740daaefa6b6df33d462ade59">3e4f978</a>
    </p>
  </div>
  <div itemprop="text" class="Box-body p-0 blob-wrapper blob-wrapper-embedded data">
    <table class="highlight tab-size mb-0 js-file-line-container" data-tab-size="8" data-paste-markdown-skip="">

        <tbody><tr class="border-0">
          <td id="L49" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="49"></td>
          <td id="LC49" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line"> <span class="pl-k">if</span> (!is_scalar(<span class="pl-s1"><span class="pl-c1">$</span>value</span>) &amp;&amp; !(is_object(<span class="pl-s1"><span class="pl-c1">$</span>value</span>) &amp;&amp; method_exists(<span class="pl-s1"><span class="pl-c1">$</span>value</span>, <span class="pl-s">'__toString'</span>))) { </td>
        </tr>

        <tr class="border-0">
          <td id="L50" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="50"></td>
          <td id="LC50" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-k">throw</span> <span class="pl-k">new</span> <span class="pl-v">UnexpectedTypeException</span>(<span class="pl-s1"><span class="pl-c1">$</span>value</span>, <span class="pl-s">'string'</span>); </td>
        </tr>

        <tr class="border-0">
          <td id="L51" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="51"></td>
          <td id="LC51" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line"> } </td>
        </tr>
    </tbody></table>
  </div>
</div>
<p></p>
<p dir="auto">This is obvious, and not really an issue as field was manually changed, but this might create false positives on error logs / monitoring if abused. Wouldn't it be cleaner to add a violation to the field, simply telling that the value is not an email?</p>