{"record":{"id":"07e98111bf2ba631","repo":"passbolt/passbolt_api","slug":"0-is-not-a-valid-contain-value","errorCode":null,"errorMessage":"\"{0}\" is not a valid contain value.","messagePattern":"\"(.+?)\" is not a valid contain value\\.","errorType":"validation","errorClass":"CakeException","httpStatus":400,"severity":"error","filePath":"src/Controller/Component/QueryStringComponent.php","lineNumber":700,"sourceCode":"            }\n        }\n\n        return true;\n    }\n\n    /**\n     * Validate Contain\n     *\n     * @param array|null $contain conditions\n     * @return bool true if validate\n     * @throws \\Cake\\Core\\Exception\\CakeException if the contain value is not 0 or 1\n     */\n    public static function validateContain(?array $contain = null): bool\n    {\n        if (isset($contain)) {\n            foreach ($contain as $value) {\n                if (!is_bool($value)) {\n                    throw new CakeException(__('\"{0}\" is not a valid contain value.', $value));\n                }\n            }\n        }\n\n        return true;\n    }\n\n    /**\n     * Normalize string to boolean if it looks like one\n     * 'TRUE', 'True', 'true', '1' becomes true\n     * 'FALSE', 'False', 'false', '0' becomes false\n     *\n     * @param mixed $str the string to normalize\n     * @return string|bool if original string is not bool\n     */\n    public static function normalizeBoolean(mixed $str)\n    {\n        if (is_bool($str)) {","sourceCodeStart":682,"sourceCodeEnd":718,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Controller/Component/QueryStringComponent.php#L682-L718","documentation":"validateContain checks each value of the 'contain' query-string parameter; every contain value must be a boolean indicating whether to include the associated data. It throws when a contain value is not a boolean, rejecting strings or numbers that the API will not coerce.","triggerScenarios":"GET /resources?contain[permissions]=1 or contain[creator]=yes — PHP accepts '1'/'0' in some contexts but the validated value must resolve to a boolean (true/false).","commonSituations":"Clients using 1/0 or yes/no instead of true/false; curl users forgetting to quote values so shells mangle them; older API clients using legacy contain conventions.","solutions":["Use contain[<association>]=true or contain[<association>]=false exactly.","Check the controller's allowed contain names to pick a valid association key.","Quote the whole URL in curl to avoid shell corruption of brackets and values.","Update legacy clients that send 1/0 to send true/false."],"exampleFix":"// before\nGET /resources?contain[permissions]=1\n// after\nGET /resources?contain[permissions]=true","handlingStrategy":"validation","validationCode":"if (typeof containValue !== 'boolean') {\n  throw new Error(`contain[${key}] must be true or false`);\n}","typeGuard":"function isBoolean(v: unknown): v is boolean {\n  return typeof v === 'boolean';\n}","tryCatchPattern":null,"preventionTips":["Always send literal true/false for contain parameters","Quote URLs in curl to preserve brackets","Migrate legacy clients sending 1/0 to booleans"],"tags":["query-string","validation","contain"],"backgroundTag":"invalid-argument-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}