Replace Zend_Validate with symfony/validator

[sreichel]

Description (*)

Replace Zend_Validate with symfony/validator.

Added new helper Mage_Core_Helper_Validate that contains some wrapper methods for symfony validation.
Moved some parts of Zend_Validate_Abstract to Mage_Core_Helper_Validation_Abstract for some backwacrd compa. (may be removed later).

Related Pull Requests

• see Replace Zend_Validate with laminas-validate #3199

[sonarqubecloud]

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Hanmac]

sad no symfony noises xD

Also, you might need to look at this:

@deprecated Calling `validate()` directly from rules is deprecated. Please use {@see \Respect\Validation\Validator::isValid()} instead.

[sreichel]

sad no symfony noises xD

I tried, but writing rules is more intuitive with that ... imho.

Also, you might need to look at this:

@deprecated Calling `validate()` directly from rules is deprecated. Please use {@see \Respect\Validation\Validator::isValid()} instead.

I am aware of it, but latest version requies php 8.1.

[Hanmac]

for the current changes in this MR, Symfony Validator might be easy too.

the bigger use would be that we could validate entire objects like Customer Address at once

Also the Intl/Translation support is nice, so we could have the errors already translated by the System

[mattdavenport]

I would be in favor of switching this to Symfony validation. Looking at this from a bigger picture, it would be best if we picked a library of components (e.g. Symfony/Laminas/etc.) and stuck to those throughout the project when replacing outdated libraries. IMO not doing this will increase the maintenance burden long term with differing packages/conventions to keep track of.

[Copilot]

Pull Request Overview

This PR replaces the legacy Zend_Validate validation framework with Symfony's symfony/validator component, modernizing the validation layer across the OpenMage codebase. The changes introduce a new helper class Mage_Core_Helper_Validate that wraps Symfony validation functionality, and updates all existing validation calls throughout the codebase to use this new approach.

Key changes include:

• Added new Mage_Core_Helper_Validate helper with wrapper methods for common validation operations
• Created Mage_Core_Helper_Validate_Abstract base class for backward compatibility with existing validator patterns
• Migrated all Zend_Validate usage to Symfony validators across models, controllers, and helpers
• Updated test data providers to reflect new validation error messages

Reviewed Changes

Copilot reviewed 71 out of 72 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
composer.json	Added symfony/validator and symfony/mime dependencies
app/code/core/Mage/Core/Helper/Validate.php	New validation helper with Symfony wrapper methods
app/code/core/Mage/Core/Helper/Validate/Abstract.php	Abstract base class for custom validators
app/code/core/Mage/Core/Helper/Validate/Interface.php	Interface defining validation contract
app/code/core/Mage/Core/Model/Abstract.php	Added getValidationHelper() method for easy access
app/code/core/Mage/Customer/Model/Customer.php	Migrated customer validation to new system
app/code/core/Mage/Newsletter/Model/Template.php	Updated template validation logic
app/code/core/Mage/Oauth/Model/Token.php	Replaced custom key length validators
tests/unit/Mage/Newsletter/Model/TemplateTest.php	Updated test expectations for new error messages
Multiple test files	Updated test data providers for new validation behavior

Comments suppressed due to low confidence (1)

app/code/core/Mage/Customer/controllers/AccountController.php:1

• The removal of early return statements at lines 793 and 796 changes the control flow. While both code paths now fall through to implicit returns, this is less explicit than the original early returns and could make debugging more difficult. Consider keeping the explicit return statements for clarity.

<?php

[Copilot]

Changed from !isset($data['attribute_set_id']) || empty($data['attribute_set_id']) to just empty($data['attribute_set_id']). While functionally equivalent (empty() checks both isset and truthiness), this changes the behavior subtly: empty() will return true for '0' and 0, whereas the original would only check if the key exists and has a truthy value. Verify this doesn't break validation for legitimate zero values.

Suggested change

	if (empty($data['attribute_set_id'])) {
	$this->_critical('Missing "attribute_set_id" in request.', Mage_Api2_Model_Server::HTTP_BAD_REQUEST);
	if (!isset($data['attribute_set_id']) || !is_numeric($data['attribute_set_id']) || (int)$data['attribute_set_id'] <= 0) {
	$this->_critical('Missing or invalid "attribute_set_id" in request.', Mage_Api2_Model_Server::HTTP_BAD_REQUEST);

[Copilot]

Changed from !isset($data['attribute_set_id']) || empty($data['attribute_set_id']) to just empty($data['attribute_set_id']). While functionally equivalent (empty() checks both isset and truthiness), this changes the behavior subtly: empty() will return true for '0' and 0, whereas the original would only check if the key exists and has a truthy value. Verify this doesn't break validation for legitimate zero values.

[sonarqubecloud]

Quality Gate failed

Failed conditions
7.1% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud