Magento 2's Hidden 500 Errors: When related_product and coupon_code Break Your Cart

Magento 2's Hidden 500 Errors: When related_product and coupon_code Break Your Cart

At Shopping Mover, we constantly monitor the Magento ecosystem for critical insights that impact merchants and developers. A recent GitHub issue (#41538) has brought to light a significant bug in Magento 2.4.x that can lead to unexpected HTTP 500 errors during crucial checkout processes: adding products to the cart and applying coupons. This issue, identified from production error monitoring, highlights a fundamental flaw in how Magento handles certain input parameters.

The Core Problem: Unexpected Array Inputs

The bug manifests when the related_product parameter during an add-to-cart request, or the coupon_code parameter during a coupon application, is sent as an array instead of the expected string. While Magento's storefront forms typically send these as strings, custom integrations, APIs, or even malformed requests could inadvertently send them as arrays (e.g., related_product[]=1 instead of related_product=1).

Instead of gracefully handling the invalid input with a redirect or a user-friendly error message, Magento's core controllers throw a PHP TypeError, resulting in a server-side HTTP 500 error. This is problematic because 500 errors are opaque to the user and indicate a critical failure, potentially disrupting the shopping experience and leading to lost conversions.

Unpacking the Technical Details

The issue's author, lbajsarowicz, provided clear reproduction steps, initially using curl and later with browser console fetch requests. The core of the problem lies in the following lines of code within Magento's core modules:

• In app/code/Magento/Checkout/Controller/Cart/Add.php:147, the execute() method attempts to call explode(',', $related) on the related_product parameter. If $related is an array, explode() throws a TypeError.
• Similarly, in app/code/Magento/Checkout/Controller/Cart/CouponPost.php:71, the execute() method calls trim() on the coupon_code parameter. If $coupon_code is an array, trim() also throws a TypeError.

Crucially, these TypeError exceptions are not caught by the generic catch (\Exception) blocks present in these controllers, allowing them to propagate and cause the HTTP 500 response.

Here's a simplified representation of the problematic requests:

// Add to cart with array-valued related_product
curl -sk -o /dev/null -w '%{http_code}
' -b 'form_key=abcdefghijklmnop' -X POST https://magento.example.com/checkout/cart/add/ --data 'form_key=abcdefghijklmnop&product=4&qty=1&related_product[]=1'

// Apply coupon with array-valued coupon_code
curl -sk -o /dev/null -w '%{http_code}
' -b 'form_key=abcdefghijklmnop' -X POST https://magento.example.com/checkout/cart/couponPost/ --data 'form_key=abcdefghijklmnop&coupon_code[]=x'

Both requests, when executed against a vulnerable Magento 2.4.x instance with a valid form key and product ID, result in an HTTP 500 error instead of the expected HTTP 302 redirect.

Community Collaboration and Confirmation

The community's response was swift. After an initial challenge in reproducing the issue, lbajsarowicz provided highly detailed and robust reproduction steps, including a JavaScript snippet for browser-based testing. This clarity allowed the Magento engineering team (engcom-Bravo) to confirm the bug's reproducibility on a clean 2.4-develop instance, marking it as a confirmed issue with P2 priority.

Impact on Magento Stores and Developers

For Magento merchants, this bug means that certain third-party integrations, custom modules, or even unusual bot activity sending malformed requests could lead to critical failures in the checkout flow. This can result in a poor user experience and directly impact sales. Developers need to be aware of this potential vulnerability when building or integrating systems that interact with Magento's cart and coupon functionalities.

The issue highlights the importance of robust input validation and error handling in core e-commerce platforms. While the parameters are typically strings, expecting and validating against unexpected types is crucial for system stability.

Moving Forward: What This Means for Your Magento Migration or Development

As e-commerce migration experts, we emphasize that understanding such core platform behaviors is vital. If you're running Magento 2.4.x, especially if you have custom integrations or are planning a migration, be mindful of how data is passed to these critical endpoints. While a fix is implied to be on the way (as per the issue's release note section), proactive monitoring for HTTP 500 errors and ensuring strict data type handling in your custom code is always a best practice. This insight underscores the continuous need for vigilance and deep technical understanding in maintaining a high-performing Magento store.