Is it possible to validate invalid json?

[Muffinman]

If I have a FormRequest validator like this:

class CreateOrderRequest extends FormRequest
{
    public function rules(): array
    {
        return [
            '*' => [
                'required',
                'array',
                'min:1',
                'max:100',
            ],
            '*.website_id' => [
                'required',
                'integer',
            ],
            '*.name' => [
                'required',
                'string',
            ],
        ];
    }
}

I was expecting it to error when posted invalid JSON:

[
  
LOL INVALID JSON HERE!!!

  {
    "website_id": 1,
    "name": "My Awesome Product",
  }
]

However it actually seems like the validator passes completely fine. This is also the case when sending an empty request body.

{
  "success": true
}

(200 OK)

Is this normal / expected behaviour?

I would expect all rules to fail, because * is not an array, and *.website_id etc. is missing.

[Muffinman]

OK so I tracked this down to ValdationRuleParser::explodeWildcardRules() which works by looping through the supplied validation data and applying validation to each matching row.

When no matching rows are supplied, the validation just passes because no rules are applied.

    protected function explodeWildcardRules($results, $attribute, $rules)
    {
        $pattern = str_replace('\*', '[^\.]*', preg_quote($attribute));

        $data = ValidationData::initializeAndGatherData($attribute, $this->data);
        
        foreach ($data as $key => $value) {
            if (Str::startsWith($key, $attribute) || (bool) preg_match('/^'.$pattern.'\z/', $key)) {
                foreach ((array) $rules as $rule) {
                    if ($rule instanceof NestedRules) {
                        $compiled = $rule->compile($key, $value, $data);

                        $this->implicitAttributes = array_merge_recursive(
                            $compiled->implicitAttributes,
                            $this->implicitAttributes,
                            [$attribute => [$key]]
                        );

                        $results = $this->mergeRules($results, $compiled->rules);
                    } else {
                        $this->implicitAttributes[$attribute][] = $key;

                        $results = $this->mergeRules($results, $key, $rule);
                    }
                }
            }
        }

        return $results;
    }

This seems a bit counter-intuitive when no data at all is supplied. It kind of feels like validation rules should still get checked against null really.

Anyway my work-around is to change my FormRequest like this.:

class CreateOrderRequest extends FormRequest
{
    public function validationData()
    {
        return ['data' => $this->all()];
    }

    public function rules(): array
    {
        return [
            'data' => [
                'required',
                'array',
                'min:1',
                'max:100',
            ],
...
}

This allows me to keep the custom Request class, but not change the structure of incoming data. Downside is that validation errors returned have an extra data.0 in the responses.