GHSA-cm46-gqf4-mv4f

namespace App\Http\Middleware; use Closure; use Illuminate\Http\Request; use Symfony\Component\HttpFoundation\Response; class PreventBruteForceOnAsyncRoute { /** * Methods that are restricted from being invoked via the async route. */ protected array $restrictedMethods = [ 'validate', 'handle', '__invoke', 'validateWith', 'validateWithBag', 'callAction', ]; /** * Handle an incoming request. */ public function handle(Request $request, Closure $next): Response { // Retrieve the current route from the request. /** @var \Illuminate\Routing\Route|null $route */ $route = $request->route(); // Allow requests to routes other than "platform.async". if ($route?->getName() !== 'platform.async') { return $next($request); } // Block requests attempting to invoke any of the restricted methods. if (in_array($route->parameter('method'), $this->restrictedMethods)) { abort(503, sprintf( 'Access to the "%s" method is restricted.', $route->parameter('method') )); } // Continue request processing for other cases. return $next($request); } }