Livewire: Added ComponentNotFoundException to $dontReport

A bot was POSTing a crafted payload to that endpoint requesting the `filament.pages.dashboard` component - a known Filament probe - while posting to the . Livewire resolved the route, couldn't find that component class, and threw `ComponentNotFoundException` uncaught, resulting in a 500.

`ComponentNotFoundException` is now in `$dontReport` (so it won't flood our error tracker) and returns a 404 JSON response, the same pattern already used for `PublicPropertyNotFoundException`. The bot gets a 404 and moves on, no more 500s.
This commit is contained in:
snipe
2026-06-09 20:33:27 +01:00
parent b0aa21bee7
commit 10703263a8
+8
View File
@@ -19,6 +19,7 @@ use Illuminate\Validation\ValidationException;
use Intervention\Image\Exception\NotSupportedException;
use JsonException;
use League\OAuth2\Server\Exception\OAuthServerException;
use Livewire\Exceptions\ComponentNotFoundException;
use Livewire\Exceptions\PublicPropertyNotFoundException;
use Symfony\Component\HttpKernel\Exception\HttpException;
use Throwable;
@@ -43,6 +44,7 @@ class Handler extends ExceptionHandler
SCIMException::class, // these generally don't need to be reported
InvalidFormatException::class,
PublicPropertyNotFoundException::class,
ComponentNotFoundException::class,
];
/**
@@ -78,6 +80,12 @@ class Handler extends ExceptionHandler
return response()->json(['message' => $e->getMessage()], 422);
}
// A request named a Livewire component that doesn't exist in this app (e.g. bots probing
// for Filament endpoints). Return 404 so it doesn't surface as a 500.
if ($e instanceof ComponentNotFoundException) {
return response()->json(['message' => 'Component not found.'], 404);
}
// CSRF token mismatch error
if ($e instanceof TokenMismatchException) {
return redirect()->back()->with('error', trans('general.token_expired'));