Reject empty `controller` in ControllerMap::resolveCustomController()

Based on the current callers of this method it is impossible that an empty
string is passed in:

- In LookupRequestRoute the matched controller will always contain a non-slash
  character, unless the URL itself only consists of slashes, which is rejected
  early.
- In ControllerMap::lookupDefaultController() the method will only be called if
  the `routePart` of the landing page matches `__WCF_CMS__` which is only the
  case if the page does not have an controller assigned. In that case the invariant
  that a custom URL must be configured holds and `->lookupCmsPage()` will not
  return an empty controller value.

diff --git a/wcfsetup/install/files/lib/system/request/ControllerMap.class.php b/wcfsetup/install/files/lib/system/request/ControllerMap.class.php
index d76adf31095be442b38fb6ce7caf52bbb4f936b0..56bf21d2dde9361fe5ce7db036d230d92d9efaf2 100644 (file)
--- a/wcfsetup/install/files/lib/system/request/ControllerMap.class.php
+++ b/wcfsetup/install/files/lib/system/request/ControllerMap.class.php
@@ -141,6 +141,10 @@ class ControllerMap extends SingletonFactory
      */
     public function resolveCustomController($application, $controller)
     {
+        if ($controller === '') {
+            throw new \InvalidArgumentException('The given controller must not be empty.');
+        }
+
         if (isset($this->applicationOverrides['lookup'][$application][$controller])) {
             $application = $this->applicationOverrides['lookup'][$application][$controller];
         }