[Form] Don't submit absent forms even when they have false_values children

In 8.1, #45081 made the request handlers call MissingDataHandler before
checking whether the form was actually present in the request. For
compound forms with false_values-aware children (expanded multiple
ChoiceType, CheckboxType, ...), the handler synthesises values for the
missing children, masking the "form absent" condition and causing the
form to be submitted on any unrelated POST to the same endpoint.

Move the early-return guard before MissingDataHandler::handle() so an
absent form is never processed.

Fixes #64315.

Author: hlecorche

Extension/HttpFoundation/HttpFoundationRequestHandler.php

@@ -61,13 +61,13 @@ public function handleRequest(FormInterface $form, mixed $request = null): void
             } else {
                 $queryData = $request->query->all()[$name] ?? $missingData;
 
-                $data = $this->missingDataHandler->handle($form, $queryData);
-
-                if ($missingData === $data) {
+                if ($missingData === $queryData) {
                     // Don't submit GET requests if the form's name does not exist
                     // in the request
                     return;
                 }
+
+                $data = $this->missingDataHandler->handle($form, $queryData);
             }
         } else {
             // Mark the form with an error if the uploaded size was too large
@@ -98,15 +98,15 @@ public function handleRequest(FormInterface $form, mixed $request = null): void
                 $files = null;
             }
 
-            if ('PATCH' !== $method) {
-                $params = $this->missingDataHandler->handle($form, $params);
-            }
-
             if ($missingData === $params) {
                 // Don't submit the form if it is not present in the request
                 return;
             }
 
+            if ('PATCH' !== $method) {
+                $params = $this->missingDataHandler->handle($form, $params);
+            }
+
             if (\is_array($params) && \is_array($files)) {
                 $data = FormUtil::mergeParamsAndFiles($params, $files);
             } else {

NativeRequestHandler.php

@@ -67,13 +67,14 @@ public function handleRequest(FormInterface $form, mixed $request = null): void
                 $data = $_GET;
             } else {
                 $queryData = $_GET[$name] ?? $missingData;
-                $data = $this->missingDataHandler->handle($form, $queryData);
 
-                if ($missingData === $data) {
+                if ($missingData === $queryData) {
                     // Don't submit GET requests if the form's name does not exist
                     // in the request
                     return;
                 }
+
+                $data = $this->missingDataHandler->handle($form, $queryData);
             }
         } else {
             // Mark the form with an error if the uploaded size was too large
@@ -109,15 +110,15 @@ public function handleRequest(FormInterface $form, mixed $request = null): void
                 $files = null;
             }
 
-            if ('PATCH' !== $method) {
-                $params = $this->missingDataHandler->handle($form, $params);
-            }
-
             if ($missingData === $params) {
                 // Don't submit the form if it is not present in the request
                 return;
             }
 
+            if ('PATCH' !== $method) {
+                $params = $this->missingDataHandler->handle($form, $params);
+            }
+
             if (\is_array($params) && \is_array($files)) {
                 $data = FormUtil::mergeParamsAndFiles($params, $files);
             } else {

Tests/AbstractRequestHandlerTestCase.php

@@ -71,7 +71,7 @@ public function testSubmitCheckboxInCollectionFormWithEmptyData($method)
             'method' => $method,
         ]);
 
-        $this->setRequestData($method, []);
+        $this->setRequestData($method, ['collection' => []]);
 
         $this->requestHandler->handleRequest($form, $this->request);
 
@@ -110,7 +110,7 @@ public function testSubmitCheckboxFormWithEmptyData($method)
         $form->get('subform')
             ->add('checkbox', CheckboxType::class);
 
-        $this->setRequestData($method, []);
+        $this->setRequestData($method, ['form' => []]);
 
         $this->requestHandler->handleRequest($form, $this->request);
 
@@ -156,18 +156,39 @@ public function testSubmitExpandedMultipleChoiceWithPartialDataDoesNotEmitArrayF
         $this->assertSame(['ROLE_USER'], $form->getData());
     }
 
+    #[DataProvider('methodProvider')]
+    public function testDoNotSubmitAbsentNamedFormWithCheckboxesWhenRequestBodyContainsOtherData($method)
+    {
+        $form = $this->factory->createNamed('form', FormType::class, null, ['method' => $method])
+            ->add('displayedColumns', ChoiceType::class, [
+                'choices' => ['foo' => 'foo', 'bar' => 'bar'],
+                'expanded' => true,
+                'multiple' => true,
+            ]);
+
+        $this->setRequestData($method, ['other_field' => 'value']);
+
+        $this->requestHandler->handleRequest($form, $this->request);
+
+        $this->assertFalse($form->isSubmitted());
+    }
+
     #[DataProvider('methodExceptPatchProvider')]
-    public function testSubmitSimpleCheckboxFormWithEmptyData($method)
+    public function testSubmitNamedFormWithMissingCheckboxesWhenFormKeyIsPresentInRequest($method)
     {
-        $form = $this->factory->createNamed('checkbox', CheckboxType::class, true, [
-            'method' => $method,
-        ]);
+        $form = $this->factory->createNamed('form', FormType::class, null, ['method' => $method])
+            ->add('displayedColumns', ChoiceType::class, [
+                'choices' => ['foo' => 'foo', 'bar' => 'bar'],
+                'expanded' => true,
+                'multiple' => true,
+            ]);
 
-        $this->setRequestData($method, []);
+        $this->setRequestData($method, ['form' => []]);
 
         $this->requestHandler->handleRequest($form, $this->request);
 
-        $this->assertFalse($form->getData());
+        $this->assertTrue($form->isSubmitted());
+        $this->assertSame([], $form->get('displayedColumns')->getData());
     }
 
     public static function methodExceptPatchProvider(): array