"type" in Constraint plugin definitions not used nor validated, should be enforced

Created on 14 November 2023, about 1 year ago
Updated 1 January 2024, about 1 year ago

Problem/Motivation

Discovered in 📌 Configuration schema & required keys Fixed .

#1845546: Implement validation for the TypedData API added the ability for a Constraint plugin to define which Typed Data types that constraint supports, for example:

 * @Constraint(
 *   id = "EntityType",
 *   label = @Translation("Entity type", context = "Validation"),
 *   type = { "entity", "entity_reference" }
 * )

Nothing in core validates this … or even uses this "type" information 😬 🤯 With the sole exception of \Drupal\Core\Validation\ConstraintManager::getDefinitionsByType(), which is used nowhere in core, except for 2 hardcoded tests in \Drupal\KernelTests\Core\TypedData\TypedDataTest::testTypedDataValidation().

Steps to reproduce

Make this change:

diff --git a/core/lib/Drupal/Core/Entity/Plugin/Validation/Constraint/EntityTypeConstraint.php b/core/lib/Drupal/Core/Entity/Plugin/Validation/Constraint/EntityTypeConstraint.php
index fe17d27275..d147e404f1 100644
--- a/core/lib/Drupal/Core/Entity/Plugin/Validation/Constraint/EntityTypeConstraint.php
+++ b/core/lib/Drupal/Core/Entity/Plugin/Validation/Constraint/EntityTypeConstraint.php
@@ -10,7 +10,7 @@
  * @Constraint(
  *   id = "EntityType",
  *   label = @Translation("Entity type", context = "Validation"),
- *   type = { "entity", "entity_reference" }
+ *   type = { "Oh hi there this is definitely not a type!", "entity", "entity_reference" }
  * )
  */
 class EntityTypeConstraint extends Constraint {

and observe that \Drupal\KernelTests\Core\TypedData\TypedDataTest::testTypedDataValidation() still passes tests. Remove the "entity" on that line, and it'll fail.

Proposed resolution

Quoting \Drupal\Core\Validation\Annotation\Constraint::$type:

  /**
   * DataType plugin IDs for which this constraint applies.
   *
   * Valid values are any types registered by the typed data API, or an array
   * of multiple type names. For supporting all types, FALSE may be specified.
   * The key defaults to an empty array, which indicates no types are supported.
   *
   * @var string|string[]|false
   *
   * @see \Drupal\Core\TypedData\Annotation\DataType
   */
  public $type = [];

👆 This means that due to the absence of validation, de facto most validation constraints in Drupal core are claiming to not be able to validate what they are in fact validating:

  •  * @Constraint(
     *   id = "ValidPath",
     *   label = @Translation("Valid path.", context = "Validation"),
     * )
    
  •  * @Constraint(
     *   id = "UniquePathAlias",
     *   label = @Translation("Unique path alias.", context = "Validation"),
     * )
    
  • et cetera

Remaining tasks

  1. >11.x behavior: Any validation constraint that does not specify type should not be usable at all.
  2. <11.x behavior: the above would be too disruptive, so allow it, but trigger a deprecation error
  3. >11.x behavior: Any validation constraint whose explicitly defined supported types do not match what type it's actually used on, should trigger a \LogicException
  4. <11.x behavior: the above would be too disruptive, so allow it, but trigger a deprecation error

User interface changes

None.

API changes

  1. >11.x behavior: Any validation constraint that does not specify type should not be usable at all.
  2. <11.x behavior: the above would be too disruptive, so allow it, but trigger a deprecation error
  3. >11.x behavior: Any validation constraint whose explicitly defined supported types do not match what type it's actually used on, should trigger a \LogicException
  4. <11.x behavior: the above would be too disruptive, so allow it, but trigger a deprecation error

Data model changes

None.

Release notes snippet

TBD

📌 Task
Status

Active

Version

11.0 🔥

Component
Typed data 

Last updated 10 days ago

  • Maintained by
  • 🇦🇹Austria @fago
Created by

🇧🇪Belgium wim leers Ghent 🇧🇪🇪🇺

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024