Hello and thanks for the module!

I have an edge case issue in mind, so I think this is a minor thing.

Problem/Motivation

When a user is requesting a file and they try to give a string as file id, it will cause a PHP exception.

TypeError: Drupal\file_download\Controller\FileDownloadDownloadController::deliver(): Argument #3 ($fid) must be of type int, string given in Drupal\file_download\Controller\FileDownloadDownloadController->deliver() (line 37 of /var/www/html/web/modules/contrib/file_download/src/Controller/FileDownloadDownloadController.php).

I would rather have it throw the NotFoundHttpException() instead of giving a php error. This comes up every now and then especially when different bots/crawlers try random urls. Sometimes they hit these file download links too and this will cause php errors appearing in logs.

Steps to reproduce

For example when requesting /file-download/download/public/test-file instead of /file-download/download/public/5561

Proposed resolution

Maybe we could have a union type hint in deliver() method and also do a small variable check afterwards?
Something like this?

public function deliver(Request $request, string $scheme, int|string $fid): BinaryFileResponse|Response {
    if (!$fid = filter_var($fid, FILTER_VALIDATE_INT)) {
      throw new NotFoundHttpException();
    }
Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

hartsak created an issue. See original summary.

hartsak’s picture

Status: Active » Needs review

I opened a merge request with some changes.
Please have a look!

  • shelane committed 6ddb66c6 on 2.x
    fix: #3557117 Throw NotFoundHttpException() when giving string as file...
shelane’s picture

Status: Needs review » Fixed

Thank you.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.