Using Laravel rules with custom validation rules

[blue32a]

Laravel Version

12.13.0

PHP Version

8.4.7

Database Driver & Version

No response

Description

Use Laravel rules with custom validation rules.

However, nested fields do not behave as expected. Nested fields are considered not verifiable.

Is this usage appropriate?

Steps To Reproduce

Custom Validation Rules

namespace App\Rules;

use Closure;
use Illuminate\Contracts\Validation\ValidationRule;
use Illuminate\Support\Facades\Validator;

class ExampleRule implements ValidationRule
{
    /**
     * Run the validation rule.
     *
     * @param  \Closure(string, ?string=): \Illuminate\Translation\PotentiallyTranslatedString  $fail
     */
    public function validate(string $attribute, mixed $value, Closure $fail): void
    {
        $validator = Validator::make(
            [$attribute => $value],
            [$attribute => ['date_format:Y/m/d']],
        );

        if ($validator->fails()) {
            $fail('error');
        }
    }
}

Tests

namespace Tests\Unit\Rules;

use App\Rules\ExampleRule;
use Illuminate\Support\Facades\Validator;
use Tests\TestCase;

class ExampleRuleTest extends TestCase
{
    public function test_non_unnested_fields_behave_as_expected(): void
    {
        $validator = Validator::make(
            ['field' => '2025-05-01'], // Value that do not pass validation
            ['field' => [new ExampleRule()],
        ]);

        $this->assertSame(true, $validator->fails()); // OK
    }

    public function test_nested_fields_do_not_behave_as_expected(): void
    {
        $validator = Validator::make(
            ['field' => ['foo' => '2025-05-01']], // Value that do not pass validation
            ['field.foo' => [new ExampleRule()]],
        );

        $this->assertSame(true, $validator->fails()); // NG
    }
}

Dump

• Illuminate\Validation\Validator::isValidatable()
  • Illuminate\Validation\Validator::presentOrRuleIsImplicit()
    • Illuminate\Validation\Concerns\ValidatesAttributes::validatePresent()

trait ValidatesAttributes
{
    public function validatePresent($attribute, $value)
    {
        dump([$this->data, $attribute, $value]);
        return Arr::has($this->data, $attribute);
    }
}

array:3 [
  0 => array:1 [
    "field" => array:1 [
      "foo" => "2025-05-01"
    ]
  ]
  1 => "field.foo"
  2 => "2025-05-01"
] // vendor/laravel/framework/src/Illuminate/Validation/Concerns/ValidatesAttributes.php:1854
array:3 [
  0 => array:1 [
    "field__dot__9tDDcjCZCvvl01xyfoo" => "2025-05-01"
  ]
  1 => "field.foo"
  2 => null
] // vendor/laravel/framework/src/Illuminate/Validation/Concerns/ValidatesAttributes.php:1854

[macropay-solutions]

The __dot__{hash} was introduced to fix the latest vulnerability GHSA-78fx-h6xr-vch4

[blue32a]

Am I using Validator::make() incorrectly? Or is it a bug?

[macropay-solutions]

@blue32a a way to be sure is to use laravel version that does not have this patch and see if it works.

[blue32a]

I tried the unpatched version (12.1.0) with the same results.

The dump is actually performed twice, the second time being unverifiable.

Apparently it is not appropriate to use Validator::make() in custom validation rules.

Thank you.

Dump (Laravel 12.1.0)

array:3 [
  0 => array:1 [
    "field" => array:1 [
      "foo" => "2025-05-01"
    ]
  ]
  1 => "field.foo"
  2 => "2025-05-01"
] // vendor/laravel/framework/src/Illuminate/Validation/Concerns/ValidatesAttributes.php:1853
array:3 [
  0 => array:1 [
    "fieldB8Qv1mYf63oZHYuwfoo" => "2025-05-01"
  ]
  1 => "field.foo"
  2 => null
] // vendor/laravel/framework/src/Illuminate/Validation/Concerns/ValidatesAttributes.php:1853