Validate view parameters against the constructor signature

ts/WoltLabSuite/Core/Component/GridView/Setup.ts

@@ -20,7 +20,7 @@ export class GridViewSetup {
     sortField: string = "",
     sortOrder: string = "ASC",
     filters?: Map<string, string>,
-    gridViewParameters?: Map<string, string>,
+    gridViewParameters?: Map<string, string | string[]>,
   ): Promise<WoltlabCoreDialog> {
     const url = new URL(`${window.WSC_RPC_API_URL}core/grid-views/render`);
     url.searchParams.set("gridView", gridViewClass);
@@ -34,7 +34,13 @@ export class GridViewSetup {
     }
     if (gridViewParameters) {
       gridViewParameters.forEach((value, key) => {
-        url.searchParams.set(`gridViewParameters[${key}]`, value);
+        if (Array.isArray(value)) {
+          value.forEach((innerValue, innerKey) => {
+            url.searchParams.set(`gridViewParameters[${key}][${innerKey}]`, innerValue);
+          });
+        } else {
+          url.searchParams.set(`gridViewParameters[${key}]`, value);
+        }
       });
     }
     const json = (await prepareRequest(url).get().fetchAsJson()) as ResponseGridView;

ts/WoltLabSuite/Core/Component/ListView/Setup.ts

@@ -17,7 +17,7 @@ export class ListViewSetup {
   async fromPreset(
     title: string,
     listViewClass: string,
-    listViewParameters?: Map<string, string>,
+    listViewParameters?: Map<string, string | string[]>,
     filters?: Map<string, string>,
     sortField: string = "",
     sortOrder: string = "ASC",
@@ -36,7 +36,13 @@ export class ListViewSetup {
     }
     if (listViewParameters) {
       listViewParameters.forEach((value, key) => {
-        url.searchParams.set(`listViewParameters[${key}]`, value);
+        if (Array.isArray(value)) {
+          value.forEach((innerValue, innerKey) => {
+            url.searchParams.set(`listViewParameters[${key}][${innerKey}]`, innerValue);
+          });
+        } else {
+          url.searchParams.set(`listViewParameters[${key}]`, value);
+        }
       });
     }
     const json = (await prepareRequest(url).get().fetchAsJson()) as ResponseListView;

wcfsetup/install/files/lib/action/GridViewColumnConfigurationAction.class.php

@@ -30,6 +30,13 @@ final class GridViewColumnConfigurationAction implements RequestHandlerInterface
     #[\Override]
     public function handle(ServerRequestInterface $request): ResponseInterface
     {
+        /**
+         * @var array{
+         *  gridView:string,
+         *  columns: list<string>,
+         *  gridViewParameters: array<string, string|string[]>
+         * } $parameters
+         */
         $parameters = Helper::mapQueryParameters(
             $request->getQueryParams(),
             <<<'EOT'
@@ -41,20 +48,18 @@ public function handle(ServerRequestInterface $request): ResponseInterface
                 EOT
         );
 
-        if (!\is_subclass_of($parameters['gridView'], AbstractGridView::class)) {
+        if (
+            !\is_subclass_of($parameters['gridView'], AbstractGridView::class)
+            || !(new \ReflectionClass($parameters['gridView']))->isInstantiable()
+        ) {
             throw new UserInputException('gridView', 'invalid');
         }
 
-        try {
-            /** @var AbstractGridView<DatabaseObject, DatabaseObjectList<DatabaseObject>> $view */
-            $view = new $parameters['gridView'](...$parameters['gridViewParameters']);
-        } catch (\ArgumentCountError | \TypeError $e) {
-            if (\ENABLE_DEBUG_MODE !== 0) {
-                throw $e;
-            } else {
-                throw new IllegalLinkException();
-            }
-        }
+        /** @var AbstractGridView<DatabaseObject, DatabaseObjectList<DatabaseObject>> $view */
+        $view = Helper::mapQueryParametersToConstructor(
+            $parameters['gridViewParameters'],
+            $parameters['gridView']
+        );
 
         if (!$view->isAccessible()) {
             throw new PermissionDeniedException();

wcfsetup/install/files/lib/action/GridViewFilterAction.class.php

@@ -30,6 +30,13 @@ final class GridViewFilterAction implements RequestHandlerInterface
     #[\Override]
     public function handle(ServerRequestInterface $request): ResponseInterface
     {
+        /**
+         * @var array{
+         *  gridView:string,
+         *  filters: string[],
+         *  gridViewParameters: array<string, string|string[]>
+         * } $parameters
+         */
         $parameters = Helper::mapQueryParameters(
             $request->getQueryParams(),
             <<<'EOT'
@@ -41,20 +48,18 @@ public function handle(ServerRequestInterface $request): ResponseInterface
                 EOT
         );
 
-        if (!\is_subclass_of($parameters['gridView'], AbstractGridView::class)) {
+        if (
+            !\is_subclass_of($parameters['gridView'], AbstractGridView::class)
+            || !(new \ReflectionClass($parameters['gridView']))->isInstantiable()
+        ) {
             throw new UserInputException('gridView', 'invalid');
         }
 
-        try {
-            /** @var AbstractGridView<DatabaseObject, DatabaseObjectList<DatabaseObject>> $view */
-            $view = new $parameters['gridView'](...$parameters['gridViewParameters']);
-        } catch (\ArgumentCountError | \TypeError $e) {
-            if (\ENABLE_DEBUG_MODE !== 0) {
-                throw $e;
-            } else {
-                throw new IllegalLinkException();
-            }
-        }
+        /** @var AbstractGridView<DatabaseObject, DatabaseObjectList<DatabaseObject>> $view */
+        $view = Helper::mapQueryParametersToConstructor(
+            $parameters['gridViewParameters'],
+            $parameters['gridView']
+        );
 
         if (!$view->isAccessible()) {
             throw new PermissionDeniedException();

wcfsetup/install/files/lib/action/ListViewFilterAction.class.php

@@ -30,6 +30,13 @@ final class ListViewFilterAction implements RequestHandlerInterface
     #[\Override]
     public function handle(ServerRequestInterface $request): ResponseInterface
     {
+        /**
+         * @var array{
+         *  listView: string,
+         *  filters: string[],
+         *  listViewParameters: array<string, string|string[]>
+         * } $parameters
+         */
         $parameters = Helper::mapQueryParameters(
             $request->getQueryParams(),
             <<<'EOT'
@@ -41,20 +48,18 @@ public function handle(ServerRequestInterface $request): ResponseInterface
                 EOT
         );
 
-        if (!\is_subclass_of($parameters['listView'], AbstractListView::class)) {
+        if (
+            !\is_subclass_of($parameters['listView'], AbstractListView::class)
+            || !(new \ReflectionClass($parameters['listView']))->isInstantiable()
+        ) {
             throw new UserInputException('listView', 'invalid');
         }
 
-        try {
-            /** @var AbstractListView<DatabaseObject, DatabaseObjectList<DatabaseObject>> $view */
-            $view = new $parameters['listView'](...$parameters['listViewParameters']);
-        } catch (\ArgumentCountError | \TypeError $e) {
-            if (\ENABLE_DEBUG_MODE !== 0) {
-                throw $e;
-            } else {
-                throw new IllegalLinkException();
-            }
-        }
+        /** @var AbstractListView<DatabaseObject, DatabaseObjectList<DatabaseObject>> $view */
+        $view = Helper::mapQueryParametersToConstructor(
+            $parameters['listViewParameters'],
+            $parameters['listView']
+        );
 
         if (!$view->isAccessible()) {
             throw new PermissionDeniedException();

wcfsetup/install/files/lib/http/Helper.class.php

@@ -187,6 +187,79 @@ public static function mapApiParameters(ServerRequestInterface $request, string
         };
     }
 
+    /**
+     * Creates an instance of the provided class by validating the query
+     * parameters against the signature of its constructor. Unknown keys
+     * are skipped and values are gracefully converted into the requested
+     * types. Parameters without a specific type, such as a plain `array`,
+     * are passed through as-is.
+     *
+     * Missing parameters or values that cannot be casted to the requested
+     * type will yield a `MappingError`. The class must be instantiable and
+     * its constructor may only accept builtin types, objects cannot be
+     * safely created from user input.
+     *
+     * @template T of object
+     * @param mixed[] $queryParameters
+     * @param class-string<T> $className
+     * @return T
+     * @throws MappingError
+     * @throws \LogicException
+     * @since 6.3
+     */
+    public static function mapQueryParametersToConstructor(array $queryParameters, string $className): object
+    {
+        $reflectionClass = new \ReflectionClass($className);
+        $constructor = $reflectionClass->getConstructor();
+        if ($constructor === null) {
+            return $reflectionClass->newInstance();
+        }
+
+        foreach ($constructor->getParameters() as $parameter) {
+            if (!self::isBuiltinType($parameter->getType())) {
+                throw new \LogicException(\sprintf(
+                    "The parameter '%s' of '%s::__construct()' must be of a builtin type.",
+                    $parameter->getName(),
+                    $className
+                ));
+            }
+        }
+
+        // Only the constructor arguments are mapped, mapping the whole object
+        // would also attempt to populate all other properties of the class.
+        $object = $reflectionClass->newInstanceWithoutConstructor();
+        $constructorClosure = $constructor->getClosure($object);
+
+        $arguments = (new MapperBuilder())
+            ->allowSuperfluousKeys()
+            ->allowScalarValueCasting()
+            ->allowUndefinedValues()
+            ->allowPermissiveTypes()
+            ->argumentsMapper()
+            ->mapArguments($constructorClosure, Source::array($queryParameters));
+
+        $constructorClosure(...$arguments);
+
+        return $object;
+    }
+
+    /**
+     * Returns true if the type and, for union types, all of its members
+     * are builtin types. Missing types are treated as `mixed`.
+     */
+    private static function isBuiltinType(?\ReflectionType $type): bool
+    {
+        return match (true) {
+            $type === null => true,
+            $type instanceof \ReflectionNamedType => $type->isBuiltin(),
+            $type instanceof \ReflectionUnionType => \array_all(
+                $type->getTypes(),
+                static fn(\ReflectionType $type) => self::isBuiltinType($type)
+            ),
+            default => false,
+        };
+    }
+
     /**
      * Fetch a database object using a parameter value in the URL.
      *

wcfsetup/install/files/lib/page/CombinedTaggedPage.class.php

@@ -101,6 +101,9 @@ public function readParameters()
             throw new IllegalLinkException();
         }
 
+        // Restrict the tag ids to existing tags and normalize them into a list.
+        $this->tagIDs = \array_keys($this->tags);
+
         $this->availableObjectTypes = ObjectTypeCache::getInstance()->getObjectTypes('com.woltlab.wcf.tagging.taggableObject');
         foreach ($this->availableObjectTypes as $key => $objectType) {
             if (!$objectType->validateOptions() || !$objectType->validatePermissions()) {

wcfsetup/install/files/lib/page/TaggedListViewPage.class.php

@@ -92,6 +92,9 @@ public function readParameters()
             throw new IllegalLinkException();
         }
 
+        // Restrict the tag ids to existing tags and normalize them into a list.
+        $this->tagIDs = \array_keys($this->tags);
+
         $this->loadObjectTypes();
         if ($this->availableObjectTypes === []) {
             throw new IllegalLinkException();

wcfsetup/install/files/lib/system/endpoint/controller/core/gridViews/GetGridView.class.php

@@ -28,11 +28,17 @@ public function __invoke(ServerRequestInterface $request, array $variables): Res
     {
         $parameters = Helper::mapApiParameters($request, GetGridViewParameters::class);
 
-        if (!\is_subclass_of($parameters->gridView, AbstractGridView::class)) {
+        if (
+            !\is_subclass_of($parameters->gridView, AbstractGridView::class)
+            || !(new \ReflectionClass($parameters->gridView))->isInstantiable()
+        ) {
             throw new UserInputException('gridView', 'invalid');
         }
 
-        $view = new $parameters->gridView(...$parameters->gridViewParameters);
+        $view = Helper::mapQueryParametersToConstructor(
+            $parameters->gridViewParameters,
+            $parameters->gridView
+        );
         // @phpstan-ignore function.alreadyNarrowedType, instanceof.alwaysTrue
         \assert($view instanceof AbstractGridView);
 

wcfsetup/install/files/lib/system/endpoint/controller/core/gridViews/GetRow.class.php

@@ -28,11 +28,17 @@ public function __invoke(ServerRequestInterface $request, array $variables): Res
     {
         $parameters = Helper::mapApiParameters($request, GetRowParameters::class);
 
-        if (!\is_subclass_of($parameters->gridView, AbstractGridView::class)) {
+        if (
+            !\is_subclass_of($parameters->gridView, AbstractGridView::class)
+            || !(new \ReflectionClass($parameters->gridView))->isInstantiable()
+        ) {
             throw new UserInputException('gridView', 'invalid');
         }
 
-        $view = new $parameters->gridView(...$parameters->gridViewParameters);
+        $view = Helper::mapQueryParametersToConstructor(
+            $parameters->gridViewParameters,
+            $parameters->gridView
+        );
         // @phpstan-ignore function.alreadyNarrowedType, instanceof.alwaysTrue
         \assert($view instanceof AbstractGridView);
 

wcfsetup/install/files/lib/system/endpoint/controller/core/gridViews/GetRows.class.php

@@ -28,11 +28,17 @@ public function __invoke(ServerRequestInterface $request, array $variables): Res
     {
         $parameters = Helper::mapApiParameters($request, GetRowsParameters::class);
 
-        if (!\is_subclass_of($parameters->gridView, AbstractGridView::class)) {
+        if (
+            !\is_subclass_of($parameters->gridView, AbstractGridView::class)
+            || !(new \ReflectionClass($parameters->gridView))->isInstantiable()
+        ) {
             throw new UserInputException('gridView', 'invalid');
         }
 
-        $view = new $parameters->gridView(...$parameters->gridViewParameters);
+        $view = Helper::mapQueryParametersToConstructor(
+            $parameters->gridViewParameters,
+            $parameters->gridView
+        );
         // @phpstan-ignore function.alreadyNarrowedType, instanceof.alwaysTrue
         \assert($view instanceof AbstractGridView);
 

wcfsetup/install/files/lib/system/endpoint/controller/core/listViews/GetItem.class.php

@@ -28,11 +28,17 @@ public function __invoke(ServerRequestInterface $request, array $variables): Res
     {
         $parameters = Helper::mapApiParameters($request, GetItemParameters::class);
 
-        if (!\is_subclass_of($parameters->listView, AbstractListView::class)) {
+        if (
+            !\is_subclass_of($parameters->listView, AbstractListView::class)
+            || !(new \ReflectionClass($parameters->listView))->isInstantiable()
+        ) {
             throw new UserInputException('listView', 'invalid');
         }
 
-        $view = new $parameters->listView(...$parameters->listViewParameters);
+        $view = Helper::mapQueryParametersToConstructor(
+            $parameters->listViewParameters,
+            $parameters->listView
+        );
         // @phpstan-ignore function.alreadyNarrowedType, instanceof.alwaysTrue
         \assert($view instanceof AbstractListView);