Skip to content

Harden range filter labels against malformed values - #1255

Open
Betafer wants to merge 1 commit into
PrestaShop:devfrom
Betafer:fix/sanitize-range-filter-boundaries
Open

Harden range filter labels against malformed values#1255
Betafer wants to merge 1 commit into
PrestaShop:devfrom
Betafer:fix/sanitize-range-filter-boundaries

Conversation

@Betafer

@Betafer Betafer commented Jun 24, 2026

Copy link
Copy Markdown

What

This PR makes range filter label generation resilient to malformed range values coming from the faceted search URL.

SearchProvider::labelRangeFilters() currently passes active range values directly to formatNumber() / formatPrice(). If a crafted URL provides a non-numeric range boundary, for example an HTML-like string, PrestaShop can throw a localization/decimal parsing exception while rendering category facets.

The change adds a small numeric boundary guard: valid numeric scalar values are preserved, invalid values fall back to the facet min/max, and a final 0 fallback is used only if both values are invalid.

Why

This prevents category/listing pages from failing when bots or malicious requests submit malformed price/weight range boundaries.

Tests

  • php -l src/Product/SearchProvider.php
  • php -l tests/php/FacetedSearch/Product/SearchProviderTest.php
  • PHP_CS_FIXER_IGNORE_ENV=1 vendor/bin/php-cs-fixer fix --no-interaction --dry-run --diff --config=.php_cs.dist src/Product/SearchProvider.php tests/php/FacetedSearch/Product/SearchProviderTest.php
  • Live validation on a PrestaShop 8 production/stage install: malformed q=Prezzo-<a><a><a><a><a>-100 AJAX category requests now return HTTP 200 and valid rendered products/facets instead of throwing cannot be interpreted as a number.

Note: the full legacy PHPUnit 5 suite could not run in my local environment because it is incompatible with PHP 8.1 (Cannot acquire reference to $GLOBALS).

@ps-jarvis

Copy link
Copy Markdown

Hello @Betafer!

This is your first pull request on ps_facetedsearch repository of the PrestaShop project.

Thank you, and welcome to this Open Source community!

@github-project-automation github-project-automation Bot moved this to Ready for review in PR Dashboard Jun 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Ready for review

Development

Successfully merging this pull request may close these issues.

2 participants