Passing null to the $user->can() method returns true

[DavidJapan]

I posted this question on Stackoverflow https://stackoverflow.com/questions/72014927/passing-null-to-the-user-can-method-returns-true. I was surprised to discover passing null to the $user->can() method returns true. Has anyone else noticed this behaviour? What did you do to prevent unintentional access to whatever functionality you were trying to protect?

[PaolaRuby]

Just don't pass null
Why somebody would pass null there?
If you did something wrong use a fallback $user->can($null ?: 'no_permission')

[DavidJapan]

It would take too long to explain why my code ended up, unintentionally, passing null. Of course, I wouldn't simply pass null as a literal string. What I'm getting at is that I was surprised the can method accepted null and even more surprised to discover it returned true. I would have expected it to return false. I spent an instructive hour or two discovering the mistakes in my own code, but surely it would be better if the can method had protected me from my mistake.

[erikn69]

the can method comes from laravel, maybe the notification must be there, not here

[DavidJapan]

Good idea. I've opened an issue there.

[erikn69]

laravel/framework#42139 (comment)

Laravel doesn't uses strict types in method signatures to enforce type safety. This parameter is marked as iterable|string only and we indeed consider this to be a userland thing to ensure.

Mark this as answered