bug #30814 [Messenger] base64_encoding inside PhpSerializer to avoid null characters (weaverryan)

fabpot · fabpot · commit 1a5ab6b750e8 · 2019-04-01T16:41:45.000+02:00
This PR was merged into the 4.3-dev branch. Discussion ---------- [Messenger] base64_encoding inside PhpSerializer to avoid null characters | Q | A | ------------- | --- | Branch? | master | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #30805 | License | MIT | Doc PR | not needed Hi! As pointed out in #30805, the `PhpSerializer` creates strings with null bytes. This apparently causes problems on at least some database systems (I didn't notice, but @vincenttouzet did). I also read that, for example, SQS doesn't like null characters. And, in general, because we're sending this data over a transport, `base64_encoding` data is pretty standard. Does anyone see any downsides? Cheers! Commits ------- fe7ad81 base64_encoding inside PhpSerializer to avoid null characters
diff --git a/src/Symfony/Component/Messenger/Tests/Transport/Serialization/PhpSerializerTest.php b/src/Symfony/Component/Messenger/Tests/Transport/Serialization/PhpSerializerTest.php
@@ -58,7 +58,7 @@ public function testDecodingFailsWithBadClass()
         $serializer = new PhpSerializer();
 
         $serializer->decode([
-            'body' => 'O:13:"ReceivedSt0mp":0:{}',
+            'body' => base64_encode('O:13:"ReceivedSt0mp":0:{}'),
         ]);
     }
 }
diff --git a/src/Symfony/Component/Messenger/Transport/Serialization/PhpSerializer.php b/src/Symfony/Component/Messenger/Transport/Serialization/PhpSerializer.php
@@ -30,7 +30,13 @@ public function decode(array $encodedEnvelope): Envelope
             throw new MessageDecodingFailedException('Encoded envelope should have at least a "body".');
         }
 
-        return $this->safelyUnserialize($encodedEnvelope['body']);
+        $serializeEnvelope = base64_decode($encodedEnvelope['body']);
+
+        if (false === $serializeEnvelope) {
+            throw new MessageDecodingFailedException('The "body" key could not be base64 decoded.');
+        }
+
+        return $this->safelyUnserialize($serializeEnvelope);
     }
 
     /**
@@ -39,7 +45,7 @@ public function decode(array $encodedEnvelope): Envelope
     public function encode(Envelope $envelope): array
     {
         return [
-            'body' => serialize($envelope),
+            'body' => base64_encode(serialize($envelope)),
         ];
     }
 

Original file line number	Diff line number	Diff line change
`@@ -58,7 +58,7 @@ public function testDecodingFailsWithBadClass()`
`58`	`58`	`$serializer = new PhpSerializer();`
`59`	`59`
`60`	`60`	`$serializer->decode([`
`61`		`- 'body' => 'O:13:"ReceivedSt0mp":0:{}',`
	`61`	`+ 'body' => base64_encode('O:13:"ReceivedSt0mp":0:{}'),`
`62`	`62`	`]);`
`63`	`63`	`}`
`64`	`64`	`}`
Original file line number	Diff line number	Diff line change
`@@ -30,7 +30,13 @@ public function decode(array $encodedEnvelope): Envelope`
`30`	`30`	`throw new MessageDecodingFailedException('Encoded envelope should have at least a "body".');`
`31`	`31`	`}`
`32`	`32`
`33`		`- return $this->safelyUnserialize($encodedEnvelope['body']);`
	`33`	`+ $serializeEnvelope = base64_decode($encodedEnvelope['body']);`
	`34`	`+`
	`35`	`+ if (false === $serializeEnvelope) {`
	`36`	`+ throw new MessageDecodingFailedException('The "body" key could not be base64 decoded.');`
	`37`	`+ }`
	`38`	`+`
	`39`	`+ return $this->safelyUnserialize($serializeEnvelope);`
`34`	`40`	`}`
`35`	`41`
`36`	`42`	`/**`
`@@ -39,7 +45,7 @@ public function decode(array $encodedEnvelope): Envelope`
`39`	`45`	`public function encode(Envelope $envelope): array`
`40`	`46`	`{`
`41`	`47`	`return [`
`42`		`- 'body' => serialize($envelope),`
	`48`	`+ 'body' => base64_encode(serialize($envelope)),`
`43`	`49`	`];`
`44`	`50`	`}`
`45`	`51`