Skip to content

[13.x] Fix doesnt_contain validation rule ignoring non-string values - #61493

Closed
lazerg wants to merge 1 commit into
laravel:13.xfrom
lazerg:fix/issue-61491-doesnt-contain
Closed

lazerg wants to merge 1 commit into
laravel:13.xfrom
lazerg:fix/issue-61491-doesnt-contain

Conversation

@lazerg

@lazerg lazerg commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

#61318 switched doesnt_contain to a strict in_array() comparison, but rule parameters always arrive as strings while the validated array can hold integers, floats or booleans. doesnt_contain:1 therefore passes for ['flags' => [1]] and lets the prohibited value through, and the same input can satisfy contains:1 and doesnt_contain:1 at the same time.

This casts the scalar values to string before the strict comparison, the same way #61146 did for the in rule. Exact string matches and the 0e123 bypass that #61318 closed both keep their current behavior.

Fixes #61491.

@lazerg

lazerg commented Sep 8, 2026

Copy link
Copy Markdown
Contributor Author

Closing in favor of #61492, which fixes both contains and doesnt_contain and covers this case.

@lazerg lazerg closed this Sep 8, 2026
@iz-ahmad

iz-ahmad commented Sep 8, 2026 •

Copy link
Copy Markdown
Contributor

Closing in favor of #61492, which fixes both contains and doesnt_contain and covers this case.

thanks for understanding.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

contains/doesnt_contain validation rules use inconsistent comparison strictness

2 participants