Skip to content

[LiveComponent] Avoid 500 errors on malformed hydration payloads#3676

Open
Amoifr wants to merge 1 commit into
symfony:3.xfrom
Amoifr:fix-livecomponent-hydration-bad-request
Open

[LiveComponent] Avoid 500 errors on malformed hydration payloads#3676
Amoifr wants to merge 1 commit into
symfony:3.xfrom
Amoifr:fix-livecomponent-hydration-bad-request

Conversation

@Amoifr

@Amoifr Amoifr commented Jun 11, 2026

Copy link
Copy Markdown
Contributor
Q A
Bug fix? yes
New feature? no
Tickets -
License MIT

Hydrating a LiveComponent from a tampered updated payload could raise an uncaught native exception and surface as a 500 instead of being ignored:

  • an array sent for a writable backed-enum prop → TypeError in BackedEnum::tryFrom()
  • an unknown property sent for a writable object prop → ReflectionException

These are only reachable by manually crafting the payload (a regular user never hits them). Each case is now turned into a HydrationException, so the malformed writable value is ignored like any other bad data and the original value is kept.

Discussed with @Kocal.

@carsonbot carsonbot added Bug Bug Fix LiveComponent Status: Needs Review Needs to be reviewed labels Jun 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants