[8.x] Using withoutMiddleware() and a closure-based middleware on PHP8 throws an exception

[patrickomeara]

PHP8 throws a TypeError when class_exists() is used on anything but a string.

Psy Shell v0.10.5 (PHP 7.4.13 — cli) by Justin Hileman
>>> class_exists(fn () => []);
<warning>PHP Warning:  class_exists() expects parameter 1 to be string, object given in Psy Shell code on line 1</warning>

Psy Shell v0.10.5 (PHP 8.0.1 — cli) by Justin Hileman
>>> class_exists(fn () => []);
TypeError: class_exists(): Argument #1 ($class) must be of type string, Closure given

This can be replicated by using a closure-based middleware in a controller and removing a class-based middleware from a route.

// app/Http/Kernel.php
class Kernel extends HttpKernel
{
    protected $middleware = [
        \App\Http\Middleware\ContentSecurityPolicy::class,
    ];
}

// app/Http/Controllers/UsersController.php
class UserController extends Controller
{
    /**
     * Instantiate a new controller instance.
     *
     * @return void
     */
    public function __construct()
    {
        $this->middleware(function ($request, $next) {
            return $next($request);
        });
    }
}

// routes/web.php
Route::get('/users', [UsersController::class, 'list'])
    ->withoutMiddleware(ContentSecurityPolicy::class);

[GrahamCampbell]

Is this issue present on 6.x too?

[patrickomeara]

I've looked through the code in 6.x and 7.x and it looks like both versions won't have this issue as they don't use class_exists in the gatherRouteMiddleware method.

I've not tried either though.

[patrickomeara]

Confirmed, it's not an issue on 6.x (no withoutMiddleware() method) or 7.x (different logic, doesn't use class_exists)