sensio/SensioFrameworkExtraBundle — pull request #137 by beberlei (2012-07-21 00:50:31+00:00)
Title: [ParamConverters] Object ParamConverter

Allows to convert user input into object graphs. Use-case could be criteria/query objects or other lightweight objects that are not persistent.

See the documentation update for details on how this converter works and the security implications.

Open question: one way to avoid potential security problems might be only allowing this from $request->query - never from $request->request. Currently its adapting to the request method (which might not be that a good idea given POST requests with query parameters).