TrimString middleware adds invisible characters (#38117)

allowing · jie · web-flow · commit 709714d3d296 · 2021-07-23T09:34:55.000-05:00
Co-authored-by: jie &lt;jie@example.com&gt;
diff --git a/src/Illuminate/Foundation/Http/Middleware/TrimStrings.php b/src/Illuminate/Foundation/Http/Middleware/TrimStrings.php
@@ -53,7 +53,7 @@ protected function transform($key, $value)
             return $value;
         }
 
-        return is_string($value) ? trim($value) : $value;
+        return is_string($value) ? trim($value, "  \t\n\r\0\x0B") : $value;
     }
 
     /**
diff --git a/tests/Foundation/Http/Middleware/TrimStringsTest.php b/tests/Foundation/Http/Middleware/TrimStringsTest.php
@@ -28,6 +28,21 @@ public function testTrimStringsIgnoringExceptAttribute()
             $this->assertSame('  010  ', $request->get('bar'));
         });
     }
+
+    public function testTrimStringsNBSP()
+    {
+        $middleware = new TrimStrings;
+        $symfonyRequest = new SymfonyRequest([
+            // Here has some NBSP, but it still display to space.
+            'abc' => '   123    ',
+        ]);
+        $symfonyRequest->server->set('REQUEST_METHOD', 'GET');
+        $request = Request::createFromBase($symfonyRequest);
+
+        $middleware->handle($request, function (Request $request) {
+            $this->assertSame('123', $request->get('abc'));
+        });
+    }
 }
 
 class TrimStringsWithExceptAttribute extends TrimStrings

Original file line number	Diff line number	Diff line change
`@@ -53,7 +53,7 @@ protected function transform($key, $value)`
`53`	`53`	`return $value;`
`54`	`54`	`}`
`55`	`55`
`56`		`- return is_string($value) ? trim($value) : $value;`
	`56`	`+ return is_string($value) ? trim($value, " \t\n\r\0\x0B") : $value;`
`57`	`57`	`}`
`58`	`58`
`59`	`59`	`/**`