[Issue] Fix TypeError when the type param is missing on the admin new product page

[m2-assistant]

This issue is automatically created based on existing pull request: #41105: Fix TypeError when the type param is missing on the admin new product page

---

Description (*)

Opening the admin "New Product" page without a type request parameter throws a fatal TypeError instead of forwarding to noroute:

TypeError: Magento\Framework\RegexValidator::validateParamRegex(): Argument #1 ($params) must be of type string, null given,
called in .../Magento/Catalog/Controller/Adminhtml/Product/NewAction.php on line 71
in .../Magento/Framework/RegexValidator.php:43

NewAction::execute() passes the raw request param straight into RegexValidator::validateParamRegex(), which is declared as string $params. RequestInterface::getParam() returns null when the parameter is absent, so the request dies with a 500. The same happens for an array param (?type[]=simple), which produces array given.

Magento\Sales\Controller\Adminhtml\Order\Create\LoadBlock already guards its call to the same method; NewAction does not. This change applies the same guard and forwards to noroute for any non-string type, so the validation introduced in AC-7025 keeps working while an absent parameter no longer 500s.

Related Pull Requests

The same fix submitted to Mage-OS: mage-os/mageos-magento2#318

Fixed Issues (if relevant)

No linked GitHub issue; reported from a production exception.log.

Manual testing scenarios (*)

1. Log into the admin panel.
2. Visit admin/catalog/product/new/ (no type and no set in the URL).
   • Before: HTTP 500, TypeError in var/log/exception.log.
   • After: forwarded to the 404 / noroute page.
3. Visit admin/catalog/product/new/?type[]=simple.
   • Before: HTTP 500, TypeError ... array given.
   • After: forwarded to the 404 / noroute page.
4. Visit a regular admin/catalog/product/new/set/4/type/simple/ URL and confirm the new product form still loads.
5. Confirm the original protection still holds: a type param containing layout-handle injection characters still forwards to noroute.

Questions or comments

The alternative fix would be widening RegexValidator::validateParamRegex() to accept ?string. That changes a public method signature on a non-final framework class, so I kept the change in the caller instead, matching the existing LoadBlock pattern. Happy to switch approaches if you prefer the framework-level fix.

Contribution checklist (*)

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All new or changed code is covered with unit tests (Magento\Catalog\Test\Unit\Controller\Adminhtml\Product\NewActionTest::testExecuteWithoutTypeParam and ::testExecuteWithNonStringTypeParam, both reproduce the reported TypeError without the fix)
• All automated tests passed successfully (vendor/bin/phpunit -c dev/tests/unit/phpunit.xml.dist app/code/Magento/Catalog/Test/Unit/Controller/Adminhtml/Product/NewActionTest.php)

[engcom-Bravo]

Hi @michielgerritsen,

Thanks for your reporting and collaboration.

We have tried to reproduce the issue in latest 2.4-develop instance and we are not able to reproduce the issue.Please refer the screenshots.

It is already forwarded to 404 / noroute page.Could you please let us know if we are missing anything.

Thanks.