feat(state): reject empty values cast to a scalar native type with 400

ValueCaster throws a Bad Request when an empty string is cast to a
bool/int/float native type: an empty value cannot represent the type and
must not reach the filter as a raw, untyped value (which caused
driver-specific errors such as PostgreSQL rejecting '' for an integer).

The exception is a new framework-agnostic
ApiPlatform\Metadata\Exception\BadRequestException (implements
HttpExceptionInterface, status 400); the Laravel ErrorRenderer now maps
Metadata\Exception\HttpExceptionInterface like the Symfony ErrorListener
already does.

Non-empty uncastable values are still returned unchanged so constraint
validation rejects them (422); parameters without castToNativeType keep
the empty string, so e.g. a string filter can still match it.

Author: soyuka

src/Laravel/Exception/ErrorRenderer.php

@@ -15,6 +15,7 @@
 
 use ApiPlatform\Laravel\ApiResource\Error;
 use ApiPlatform\Laravel\Controller\ApiPlatformController;
+use ApiPlatform\Metadata\Exception\HttpExceptionInterface;
 use ApiPlatform\Metadata\Exception\InvalidUriVariableException;
 use ApiPlatform\Metadata\Exception\ProblemExceptionInterface;
 use ApiPlatform\Metadata\Exception\StatusAwareExceptionInterface;
@@ -186,7 +187,7 @@ private function getStatusCode(?HttpOperation $apiOperation, ?HttpOperation $err
             return 403;
         }
 
-        if ($exception instanceof SymfonyHttpExceptionInterface) {
+        if ($exception instanceof SymfonyHttpExceptionInterface || $exception instanceof HttpExceptionInterface) {
             return $exception->getStatusCode();
         }
 

src/Metadata/Exception/BadRequestException.php

@@ -0,0 +1,33 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Metadata\Exception;
+
+/**
+ * Framework-agnostic 400 Bad Request, mapped by both the Symfony and Laravel error handlers.
+ */
+class BadRequestException extends \RuntimeException implements ExceptionInterface, HttpExceptionInterface
+{
+    public function getStatusCode(): int
+    {
+        return 400;
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    public function getHeaders(): array
+    {
+        return [];
+    }
+}

src/State/Parameter/ValueCaster.php

@@ -13,10 +13,12 @@
 
 namespace ApiPlatform\State\Parameter;
 
+use ApiPlatform\Metadata\Exception\BadRequestException;
+
 /**
- * Caster returns the default value when a value can not be casted
- * This is used by parameters before they get validated by constraints
- * Therefore we do not need to throw exceptions, validation will just fail.
+ * Caster returns the value unchanged when it can not be casted, so constraint validation can
+ * reject it. An empty string is the exception: it can not represent a scalar native type, so we
+ * throw a Bad Request (400) rather than letting it reach the filter as a raw, untyped value.
  *
  * @internal
  */
@@ -30,7 +32,8 @@ public static function toBool(mixed $v): mixed
 
         return match (strtolower($v)) {
             '1', 'true' => true,
-            '0', 'false', '' => false,
+            '0', 'false' => false,
+            '' => throw new BadRequestException('An empty value cannot be cast to a boolean.'),
             default => $v,
         };
     }
@@ -42,7 +45,7 @@ public static function toInt(mixed $v): mixed
         }
 
         if ('' === $v) {
-            return 0;
+            throw new BadRequestException('An empty value cannot be cast to an integer.');
         }
 
         $value = filter_var($v, \FILTER_VALIDATE_INT);
@@ -57,7 +60,7 @@ public static function toFloat(mixed $v): mixed
         }
 
         if ('' === $v) {
-            return 0.0;
+            throw new BadRequestException('An empty value cannot be cast to a float.');
         }
 
         $value = filter_var($v, \FILTER_VALIDATE_FLOAT);

src/State/Tests/Parameter/ValueCasterTest.php

@@ -13,6 +13,7 @@
 
 namespace ApiPlatform\State\Tests\Parameter;
 
+use ApiPlatform\Metadata\Exception\BadRequestException;
 use ApiPlatform\State\Parameter\ValueCaster;
 use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\TestCase;
@@ -25,6 +26,19 @@ public function testToBool(mixed $value, mixed $expected): void
         $this->assertSame($expected, ValueCaster::toBool($value));
     }
 
+    public static function boolProvider(): \Generator
+    {
+        yield 'true string' => ['true', true];
+        yield 'numeric 1' => ['1', true];
+        yield 'false string' => ['false', false];
+        yield 'numeric 0' => ['0', false];
+        // Unrecognized values (including "null") are returned untouched so constraint validation
+        // rejects them.
+        yield 'invalid string' => ['string', 'string'];
+        yield 'null string is not cast' => ['null', 'null'];
+        yield 'non-string passthrough' => [true, true];
+    }
+
     #[DataProvider('intProvider')]
     public function testToInt(mixed $value, mixed $expected): void
     {
@@ -34,7 +48,6 @@ public function testToInt(mixed $value, mixed $expected): void
     public static function intProvider(): \Generator
     {
         yield 'integer string' => ['10', 10];
-        yield 'empty string' => ['', 0];
         yield 'invalid string' => ['string', 'string'];
         yield 'null string is not cast' => ['null', 'null'];
         yield 'int passthrough' => [10, 10];
@@ -49,25 +62,26 @@ public function testToFloat(mixed $value, mixed $expected): void
     public static function floatProvider(): \Generator
     {
         yield 'float string' => ['1.5', 1.5];
-        yield 'empty string' => ['', 0.0];
         yield 'invalid string' => ['string', 'string'];
         yield 'null string is not cast' => ['null', 'null'];
         yield 'float passthrough' => [1.5, 1.5];
     }
 
-    public static function boolProvider(): \Generator
+    /**
+     * An empty string cannot represent a scalar native type, so the caster rejects it with a
+     * Bad Request rather than leaving a raw value for the filter.
+     */
+    #[DataProvider('emptyCasterProvider')]
+    public function testEmptyValueThrowsBadRequest(callable $caster): void
     {
-        yield 'true string' => ['true', true];
-        yield 'numeric 1' => ['1', true];
-        yield 'false string' => ['false', false];
-        yield 'numeric 0' => ['0', false];
-        // An empty value casts to false deterministically across drivers, instead of
-        // reaching the database as a raw string that each driver coerces differently.
-        yield 'empty string' => ['', false];
-        // Genuinely invalid values (including "null") are returned untouched so constraint
-        // validation rejects them; "null" is not a supported boolean input.
-        yield 'invalid string' => ['string', 'string'];
-        yield 'null string is not cast' => ['null', 'null'];
-        yield 'non-string passthrough' => [true, true];
+        $this->expectException(BadRequestException::class);
+        $caster('');
+    }
+
+    public static function emptyCasterProvider(): \Generator
+    {
+        yield 'toBool' => [ValueCaster::toBool(...)];
+        yield 'toInt' => [ValueCaster::toInt(...)];
+        yield 'toFloat' => [ValueCaster::toFloat(...)];
     }
 }

tests/Functional/Parameters/BooleanFilterTest.php

@@ -77,24 +77,15 @@ public static function booleanFilterScenariosProvider(): \Generator
     }
 
     /**
-     * With the canonical ExactFilter, an empty boolean value casts to false (deterministically
-     * across drivers), so it matches the inactive rows — unlike the deprecated BooleanFilter
-     * which skipped filtering (returning all rows, covered by the legacy regression suite).
+     * An empty value cannot be cast to the boolean native type, so the caster rejects it with a
+     * Bad Request before the filter runs.
      */
     #[DataProvider('booleanFilterEmptyScenariosProvider')]
     public function testBooleanFilterWithEmptyValues(string $url): void
     {
-        $response = self::createClient()->request('GET', $url);
-        $this->assertResponseIsSuccessful();
-
-        $responseData = $response->toArray();
-        $filteredItems = $responseData['hydra:member'];
-
-        $this->assertCount(1, $filteredItems, \sprintf('Expected one inactive item for URL %s', $url));
+        self::createClient()->request('GET', $url);
 
-        foreach ($filteredItems as $item) {
-            $this->assertFalse($item['active'], 'Expected an empty boolean value to cast to false');
-        }
+        $this->assertResponseStatusCodeSame(400);
     }
 
     public static function booleanFilterEmptyScenariosProvider(): \Generator

tests/Functional/Parameters/NumericFilterTest.php

@@ -67,20 +67,15 @@ public static function rangeFilterScenariosProvider(): \Generator
     }
 
     /**
-     * With the canonical ExactFilter, an empty value casts to 0/0.0 (deterministically across
-     * drivers) and matches no row in this fixture — unlike the deprecated NumericFilter which
-     * skipped filtering (returning all rows, covered by the legacy regression suite).
+     * An empty value cannot be cast to the int/float native type, so the caster rejects it with a
+     * Bad Request before the filter runs.
      */
     #[DataProvider('emptyScenariosProvider')]
     public function testRangeFilterWithEmptyValues(string $url): void
     {
-        $response = self::createClient()->request('GET', $url);
-        $this->assertResponseIsSuccessful();
-
-        $responseData = $response->toArray();
-        $filteredItems = $responseData['hydra:member'];
+        self::createClient()->request('GET', $url);
 
-        $this->assertCount(0, $filteredItems, \sprintf('Expected no item for URL %s', $url));
+        $this->assertResponseStatusCodeSame(400);
     }
 
     public static function emptyScenariosProvider(): \Generator