Enforce that the namespace of a controller is done through an arrayorigin/strict-controller-class

Allowing to use a backslash could also lead to security issues

2 files changed, 6 insertions, 1 deletions

diff --git a/src/Router/Runner/Controller.php b/src/Router/Runner/Controller.php
index f230cb9..eb26ecd 100644
--- a/src/Router/Runner/Controller.php
+++ b/src/Router/Runner/Controller.php
@@ -75,7 +75,7 @@ class Controller extends Runner
     {
         return preg_replace_callback('/(?:^|(\w)-)(\w)/', function($match) {
             return $match[1] . strtoupper($match[2]);
-        }, strtolower($string));
+        }, strtolower(addcslashes($string, '\\')));
     }
     
     /**
diff --git a/tests/Router/Runner/ControllerTest.php b/tests/Router/Runner/ControllerTest.php
index 365ed65..5045c4d 100644
--- a/tests/Router/Runner/ControllerTest.php
+++ b/tests/Router/Runner/ControllerTest.php
@@ -78,6 +78,11 @@ class ControllerTest extends \PHPUnit_Framework_TestCase
                 'foo--bar-zoo',
                 "Can't route to controller 'Foo--barZooController': invalid classname"
             ],
+            [
+                null,
+                'Foo\Bar\zoo',
+                "Can't route to controller 'Foo\\\\bar\\\\zooController': invalid classname"
+            ]
         ];
     }