PrivateBin/lib
marouanehassine e80efda7c2 fix: return "Invalid data." instead of HTTP 500 on malformed v2 payloads
Under strict_types on PHP 8, malformed JSON API v2 payloads triggered
uncaught TypeErrors (HTTP 500) instead of the standard JSON error
response {"status":1,"message":"Invalid data."}:

- a non-numeric `v` reached `$data['v'] + 0` in Request::getData()
- a scalar `meta` reached `count($message['meta'])` in FormatV2::isValid()
- non-array adata[0] / non-string ct fields reached base64_decode(),
  strlen() and count() with the wrong types

Validate the types before the numeric coercion and before the
string/count operations, so all such inputs are rejected cleanly with
"Invalid data." instead of a fatal error. Both crashes are remotely
triggerable without authentication (availability only, no data exposure).

Adds FormatV2Test coverage for the malformed-type inputs.

Fixes #1883
2026-07-17 14:44:04 +02:00
..
Data
Exception
Model
Persistence
Proxy
.htaccess
Configuration.php
Controller.php
Filter.php
FormatV2.php
I18n.php
Json.php
Model.php
Request.php
TemplateSwitcher.php
View.php
Vizhash16x16.php