From dfafb44b11574e621bf0785f02c32b9866ab9923 Mon Sep 17 00:00:00 2001
From: antoine <guingand.antoine@gmail.com>
Date: Thu, 16 Jul 2026 14:39:23 +0200
Subject: [PATCH] Check embed class

---
 .../Controllers/Api/Embeds/HandlesEmbed.php   |  8 ++++-
 .../Embeds/ApiEmbedsFormControllerTest.php    | 35 +++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/src/Http/Controllers/Api/Embeds/HandlesEmbed.php b/src/Http/Controllers/Api/Embeds/HandlesEmbed.php
index b065bb342..330dd4871 100644
--- a/src/Http/Controllers/Api/Embeds/HandlesEmbed.php
+++ b/src/Http/Controllers/Api/Embeds/HandlesEmbed.php
@@ -9,7 +9,13 @@ trait HandlesEmbed
 {
     protected function getEmbedFromKey(string $embedKey): SharpFormEditorEmbed
     {
-        $embed = app(Str::replace('.', '\\', $embedKey));
+        $embedClass = Str::replace('.', '\\', $embedKey);
+
+        if (! is_a($embedClass, SharpFormEditorEmbed::class, true)) {
+            throw new \Exception("Embed class $embedClass is not a SharpFormEditorEmbed");
+        }
+
+        $embed = app($embedClass);
         $embed->buildEmbedConfig();
 
         return $embed;
diff --git a/tests/Http/Api/Embeds/ApiEmbedsFormControllerTest.php b/tests/Http/Api/Embeds/ApiEmbedsFormControllerTest.php
index 4902f1f2f..ae91162b9 100644
--- a/tests/Http/Api/Embeds/ApiEmbedsFormControllerTest.php
+++ b/tests/Http/Api/Embeds/ApiEmbedsFormControllerTest.php
@@ -2,6 +2,7 @@
 
 use Code16\Sharp\Auth\SharpEntityPolicy;
 use Code16\Sharp\Tests\Fixtures\Entities\PersonEntity;
+use Code16\Sharp\Tests\Fixtures\User;
 use Code16\Sharp\Tests\Http\Api\Embeds\Fixtures\ApiEmbedsFormControllerTestEmbed;
 use Illuminate\Support\Str;
 
@@ -191,3 +192,37 @@ public function view($user, $instanceId): bool
         )
         ->assertJsonValidationErrorFor('name');
 });
+
+it('fails if class is not an embed', function () {
+    $this->withoutExceptionHandling();
+
+    expect(function () {
+        $this
+            ->postJson(
+                route('code16.sharp.api.embed.instance.form.show', [
+                    'embedKey' => str(User::class)->replace('\\', '.'),
+                    'entityKey' => 'person',
+                    'instanceId' => 1,
+                ]),
+                [
+                    'name' => 'aaa',
+                ]
+            );
+    })->toThrow(Exception::class, sprintf('Embed class %s is not a SharpFormEditorEmbed', User::class));
+
+    expect(function () {
+        $this
+            ->postJson(
+                route('code16.sharp.api.embed.instance.form.update', [
+                    'embedKey' => str(User::class)->replace('\\', '.'),
+                    'entityKey' => 'person',
+                    'instanceId' => 1,
+                ]),
+                [
+                    'name' => 'aaa',
+                    'bio' => ['text' => 'aaa'],
+                ]
+            );
+    })->toThrow(Exception::class, sprintf('Embed class %s is not a SharpFormEditorEmbed', User::class));
+
+});