add a check for the request instance in FormRequest

Author: michalsn

system/HTTP/FormRequest.php

@@ -13,6 +13,7 @@
 
 namespace CodeIgniter\HTTP;
 
+use CodeIgniter\Exceptions\RuntimeException;
 use ReflectionNamedType;
 use ReflectionParameter;
 
@@ -40,7 +41,15 @@ abstract class FormRequest
      */
     final public function __construct(?IncomingRequest $request = null)
     {
-        $this->request = $request ?? service('request');
+        $request ??= service('request');
+
+        if (! $request instanceof IncomingRequest) {
+            throw new RuntimeException(
+                sprintf('%s requires an IncomingRequest instance, got %s.', static::class, $request::class),
+            );
+        }
+
+        $this->request = $request;
     }
 
     /**

tests/system/HTTP/FormRequestTest.php

@@ -14,6 +14,7 @@
 namespace CodeIgniter\HTTP;
 
 use CodeIgniter\Config\Services;
+use CodeIgniter\Exceptions\RuntimeException;
 use CodeIgniter\Superglobals;
 use CodeIgniter\Test\CIUnitTestCase;
 use CodeIgniter\Test\Mock\MockCodeIgniter;
@@ -129,6 +130,21 @@ public function testDefaultAuthorizeReturnsTrue(): void
         $this->assertTrue($formRequest->isAuthorized());
     }
 
+    public function testConstructorThrowsWhenFallbackRequestIsNotIncomingRequest(): void
+    {
+        Services::injectMock('request', new CLIRequest(new App()));
+
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('requires an IncomingRequest instance');
+
+        new class () extends FormRequest {
+            public function rules(): array
+            {
+                return [];
+            }
+        };
+    }
+
     public function testValidatedReturnsEmptyArrayBeforeResolution(): void
     {
         $formRequest = $this->makeFormRequest($this->makeRequest());