Validation rule parser removes unvalidated data from Form Requests

[sander3]

• Laravel Version: v8.55.0
• PHP Version: v8.0.8
• Database Driver & Version: N/A

Description:

The new (https://github.com/laravel/framework/blob/578a76c2d53e416ce7037bc01c96be7877ed8442/src/Illuminate/Validation/ValidationRuleParser.php) validation rule parser removes any unvalidated data from Form Requests. Previously one could not define validation rules for a certain parameter in order to allow it pass through to the validated result array. While this might be intended behaviour, it is a change that breaks some applications.

Steps To Reproduce:

1. Create a new Form Request
2. Define some validation rules
3. Add a parameter without validation rules
4. Call $request->validated()
5. See that the unvalidated data is missing

public function rules()
{
    return [
        'title' => 'required|unique:posts|max:255',
        'body' => '',
    ];
}

[driesvints]

Thanks for reporting. I'll leave it to @taylorotwell to decide if that's a breaking change. Personally I don't think it is.

[Krisell]

Thanks @sander3 for reporting this, we hit the same issue now when we tried to update.

Turns out we had lots of 'attribute' => '' rules just to include these in $request->validated() or being returned from the
->validate() call.

Our tests caught this and using 'nullable' instead seems to resolve it, but we are still validating this.

[Boorinio]

Thanks @sander3 for reporting this, we hit the same issue now when we tried to update.

Turns out we had lots of 'attribute' => '' rules just to include these in $data->validated() or being returned from the ->validate() call.

Our tests caught this and using 'nullable' instead seems to resolve it.

Nullable is not always the intended behaviour of those empty validation rules!

[sander3]

https://laravel.com/docs/8.x/validation#rule-present might cover it.

[taylorotwell]

Yeah, if you put nullable on the attribute or something that should cover it.

[bakerkretzmar]

This broke a large application of mine in production too, silently omitting a lot of data from submitted forms for several days. My tests didn't catch this, which is my fault, but I do think it's reasonable to have tests that assert just that validation on certain data passes, which I do have, and all of those still passed because validation does pass, a bunch of data just gets discarded.

In my case we're merging arrays of rules depending on other conditions, kind of like this:

public function rules()
{
    return $this->is_published ? $this->publishedRules() : $this->draftRules();
}

public function draftRules()
{
    return [
        'name' => [],
        'description' => [],
    ];
}

public function publishedRules()
{
    return array_merge($this->draftRules(), [
        'name' => ['required', 'min:20'],
        'description' => ['required', 'min:500'],
    ]);
}

When the resource is in 'draft mode' very little is validated, but we still need the data being submitted in all those fields. Since v8.55.0, because of the change linked above, none of them are included in $request->validated().