WIll this nette routing rule potentially redirect all url requests to homepage?

Question

I am in argument as junior with a senior dev that says my routing is wrong and dangerous, that potentially all request could be routed to homepege, but I think he is wrong and I even tested it. He says that by adding this

$this->router[] = new Route('/', 'Front:Bridge:default');

All routes below this definition will be ignored and everything will be routed to Front:Bridge

Which I think is BS, since the route clearly states that redirect ONLY request directly to web root to Front:Bridge. And functionality of app is indeed not changed, but he insists I am sure to introduce unforseen bug somewhere.

Whole routerFactory for ref

public function getRouter()
{
    $this->router[] = new Route('/muj-ucet[/<action=default>]', [
        'module' => 'Front',
        'presenter' => 'Account',
        'action' => [
            Route::VALUE => 'default',
            Route::FILTER_TABLE => [
                'zpravy' => 'message',
                'profil' => 'profile',
                'objednavky' => 'orders',
                'sprava-uzivatelu' => 'users'
            ],
        ],
    ]);
    $this->router[] = new Route('/', 'Front:Bridge:default');
    $this->router[] = new Route('[<lang [a-zA-Z]{2}>/]html/prihlaseni.html', 'OnlineUser:Front:Login:default');
    $this->router[] = new Route('/superadmin/prihlaseni', 'OnlineUser:Front:Login:superAdminLogin');
    $this->router[] = new Route('[<lang [a-zA-Z]{2}>/]html/registrace.html', 'OnlineUser:Front:Registration:default');
    $this->router[] = new Route('/potvrzeni-registrace', Linker::ACTION_CONFIRM_REGISTRATION);
    $this->router[] = new Route('/aktivace-uctu', Linker::ACTION_ACTIVATION_ACCOUNT);
    $this->router[] = new Route('/nove-heslo', Linker::ACTION_FORGOT_PASSWORD);
    $this->router[] = new Route('/logout', 'OnlineUser:Front:Login:logout');
    $this->router[] = new Route('/validace/<action=default>', [
        'module' => 'OnlineUser:Front',
        'presenter' => 'Validation',
        'action' => [
            Route::VALUE => 'default',
            Route::FILTER_TABLE => [
                'validace-emailu' => 'validateEmailNotExists',
                'validace-ico' => 'validateIcNotExists',
                'validace-ico-ares-heo' => 'validateIcAresAndHeO',
            ],
        ],
    ]);
    $this->router[] = new Route('[<path .+>]', 'Front:Bridge:default');
    return $this->router;
}

score 2 · Accepted Answer · answered Mar 08 '18 at 23:09

A good way to settle this debate is to pull citation from the official Nette docs.

Before we answer your question, it's important to remember the order of routes matter:

Order of routes is important, because they are tried sequentially from the first one to the last one. Basic rule is we declare routes from the most specific to the most general.

Next, recall that routing is matched exactly. If there's a route for /foo it will not match on a request for /foo/bar. There's not an official citation for this, but it's implied and easily verified with a test app.

With that knowledge, let's walk through your proposal. if you use this route:

$this->router[] = new Route('/', 'Front:Bridge:default');

You're correct. That will only match /. Not /foo, not /foo/bar, etc. Since it is so unambiguous, the order doesn't matter and there's not much room for disaster.

However there's an important route being made towards the end of your snippet:

$this->router[] = new Route('[<path .+>]', 'Front:Bridge:default');

This is a catch-all route that is different than matching / and is probably what your peer is actually worried about: Since it is ambiguous (by matching all paths!) the order of this route definitely does matter. By placing it first, all requests would redirect to Front:Bridge:default.

WIll this nette routing rule potentially redirect all url requests to homepage?

1 Answers1