[9.x] Validate ulid before route binding query (#44995)

* validate uuid before route binding query

* validate ulid in `resolveRouteBindingQuery` and add tests

* format

* Add throw in doc-block

* format

* Format

* format

* Fix format

* Fix the `timestamps`

Author: michaelnabil230

src/Illuminate/Database/Eloquent/Concerns/HasUlids.php

@@ -2,6 +2,7 @@
 
 namespace Illuminate\Database\Eloquent\Concerns;
 
+use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Support\Str;
 
 trait HasUlids
@@ -32,6 +33,29 @@ public function newUniqueId()
         return strtolower((string) Str::ulid());
     }
 
+    /**
+     * Retrieve the model for a bound value.
+     *
+     * @param  \Illuminate\Database\Eloquent\Model|\Illuminate\Database\Eloquent\Relations\Relation  $query
+     * @param  mixed  $value
+     * @param  string|null  $field
+     * @return \Illuminate\Database\Eloquent\Relations\Relation
+     *
+     * @throws \Illuminate\Database\Eloquent\ModelNotFoundException
+     */
+    public function resolveRouteBindingQuery($query, $value, $field = null)
+    {
+        if ($field && in_array($field, $this->uniqueIds()) && ! Str::isUlid($value)) {
+            throw (new ModelNotFoundException)->setModel(get_class($this), $value);
+        }
+
+        if (! $field && in_array($this->getRouteKeyName(), $this->uniqueIds()) && ! Str::isUlid($value)) {
+            throw (new ModelNotFoundException)->setModel(get_class($this), $value);
+        }
+
+        return parent::resolveRouteBindingQuery($query, $value, $field);
+    }
+
     /**
      * Get the columns that should receive a unique identifier.
      *

tests/Integration/Routing/ImplicitModelRouteBindingTest.php

@@ -2,6 +2,7 @@
 
 namespace Illuminate\Tests\Integration\Routing;
 
+use Illuminate\Database\Eloquent\Concerns\HasUlids;
 use Illuminate\Database\Eloquent\Concerns\HasUuids;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\SoftDeletes;
@@ -41,6 +42,13 @@ protected function defineDatabaseMigrations(): void
             $table->timestamps();
         });
 
+        Schema::create('tags', function (Blueprint $table) {
+            $table->ulid('id')->primary();
+            $table->string('slug');
+            $table->integer('post_id');
+            $table->timestamps();
+        });
+
         Schema::create('comments', function (Blueprint $table) {
             $table->uuid('id')->primary();
             $table->string('slug');
@@ -51,6 +59,7 @@ protected function defineDatabaseMigrations(): void
         $this->beforeApplicationDestroyed(function () {
             Schema::dropIfExists('users');
             Schema::dropIfExists('posts');
+            Schema::dropIfExists('tags');
             Schema::dropIfExists('comments');
         });
     }
@@ -261,6 +270,37 @@ public function testImplicitRouteBindingChildHasUuids()
         $response = $this->getJson("/user/{$user->id}/comment-slug/{$comment->slug}");
         $response->assertJsonFragment(['id' => $comment->id]);
     }
+
+    public function testImplicitRouteBindingChildHasUlids()
+    {
+        $user = ImplicitBindingUser::create(['name' => 'Michael Nabil']);
+        $post = ImplicitBindingPost::create(['user_id' => $user->id]);
+        $tag = ImplicitBindingTag::create([
+            'slug' => 'slug',
+            'post_id' => $post->id,
+        ]);
+
+        config(['app.key' => str_repeat('a', 32)]);
+
+        $function = function (ImplicitBindingPost $post, ImplicitBindingTag $tag) {
+            return [$post, $tag];
+        };
+
+        Route::middleware(['web'])->group(function () use ($function) {
+            Route::get('/post/{post}/tag/{tag}', $function);
+            Route::get('/post/{post}/tag-id/{tag:id}', $function);
+            Route::get('/post/{post}/tag-slug/{tag:slug}', $function);
+        });
+
+        $response = $this->getJson("/post/{$post->id}/tag/{$tag->slug}");
+        $response->assertJsonFragment(['id' => $tag->id]);
+
+        $response = $this->getJson("/post/{$post->id}/tag-id/{$tag->id}");
+        $response->assertJsonFragment(['id' => $tag->id]);
+
+        $response = $this->getJson("/post/{$post->id}/tag-slug/{$tag->slug}");
+        $response->assertJsonFragment(['id' => $tag->id]);
+    }
 }
 
 class ImplicitBindingUser extends Model
@@ -287,6 +327,25 @@ class ImplicitBindingPost extends Model
     public $table = 'posts';
 
     protected $fillable = ['user_id'];
+
+    public function tags()
+    {
+        return $this->hasMany(ImplicitBindingTag::class, 'post_id');
+    }
+}
+
+class ImplicitBindingTag extends Model
+{
+    use HasUlids;
+
+    public $table = 'tags';
+
+    protected $fillable = ['slug', 'post_id'];
+
+    public function getRouteKeyName()
+    {
+        return 'slug';
+    }
 }
 
 class ImplicitBindingComment extends Model