feature #19958 [Serializer] Throw exception when extra attributes are used during an object denor… (juliendidier)

dunglas · dunglas · commit 24d8135f17d1 · 2016-12-05T13:56:10.000+01:00
This PR was merged into the 3.3-dev branch. Discussion ---------- [Serializer] Throw exception when extra attributes are used during an object denor… | Q | A | | --- | --- | | Branch? | "master" | | Bug fix? | no | | New feature? | yes | | BC breaks? | no | | Deprecations? | no | | Tests pass? | yes | | Fixed tickets | #19948 | | License | MIT | | Doc PR | [#6975](symfony/symfony-docs#6975) | I will update the doc if you're ok with this PR. Commits ------- 565a984 throw exception when extra attributes are used during an object denormalization
diff --git a/src/Symfony/Component/Serializer/Exception/ExtraAttributesException.php b/src/Symfony/Component/Serializer/Exception/ExtraAttributesException.php
@@ -0,0 +1,27 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Serializer\Exception;
+
+/**
+ * ExtraAttributesException.
+ *
+ * @author Julien DIDIER <julien@didier.io>
+ */
+class ExtraAttributesException extends RuntimeException
+{
+    public function __construct(array $extraAttributes, \Exception $previous = null)
+    {
+        $msg = sprintf('Extra attributes are not allowed ("%s" are unknown).', implode('", "', $extraAttributes));
+
+        parent::__construct($msg, 0, $previous);
+    }
+}
diff --git a/src/Symfony/Component/Serializer/Normalizer/AbstractObjectNormalizer.php b/src/Symfony/Component/Serializer/Normalizer/AbstractObjectNormalizer.php
@@ -13,6 +13,7 @@
 
 use Symfony\Component\PropertyAccess\Exception\InvalidArgumentException;
 use Symfony\Component\Serializer\Exception\CircularReferenceException;
+use Symfony\Component\Serializer\Exception\ExtraAttributesException;
 use Symfony\Component\Serializer\Exception\LogicException;
 use Symfony\Component\Serializer\Exception\UnexpectedValueException;
 use Symfony\Component\PropertyInfo\PropertyTypeExtractorInterface;
@@ -171,8 +172,10 @@ public function denormalize($data, $class, $format = null, array $context = arra
         if (!isset($context['cache_key'])) {
             $context['cache_key'] = $this->getCacheKey($format, $context);
         }
+
         $allowedAttributes = $this->getAllowedAttributes($class, $context, true);
         $normalizedData = $this->prepareForDenormalization($data);
+        $extraAttributes = array();
 
         $reflectionClass = new \ReflectionClass($class);
         $object = $this->instantiateObject($normalizedData, $class, $context, $reflectionClass, $allowedAttributes, $format);
@@ -183,6 +186,10 @@ public function denormalize($data, $class, $format = null, array $context = arra
             }
 
             if (($allowedAttributes !== false && !in_array($attribute, $allowedAttributes)) || !$this->isAllowedAttribute($class, $attribute, $format, $context)) {
+                if (isset($context['allow_extra_attributes']) && !$context['allow_extra_attributes']) {
+                    $extraAttributes[] = $attribute;
+                }
+
                 continue;
             }
 
@@ -194,6 +201,10 @@ public function denormalize($data, $class, $format = null, array $context = arra
             }
         }
 
+        if (!empty($extraAttributes)) {
+            throw new ExtraAttributesException($extraAttributes);
+        }
+
         return $object;
     }
 
diff --git a/src/Symfony/Component/Serializer/Tests/Normalizer/AbstractObjectNormalizerTest.php b/src/Symfony/Component/Serializer/Tests/Normalizer/AbstractObjectNormalizerTest.php
@@ -37,6 +37,21 @@ public function testInstantiateObjectDenormalizer()
         $normalizer = new AbstractObjectNormalizerDummy();
         $normalizer->instantiateObject($data, $class, $context, new \ReflectionClass($class), array());
     }
+
+    /**
+     * @expectedException \Symfony\Component\Serializer\Exception\ExtraAttributesException
+     * @expectedExceptionMessage Extra attributes are not allowed ("fooFoo", "fooBar" are unknown).
+     */
+    public function testDenormalizeWithExtraAttributes()
+    {
+        $normalizer = new AbstractObjectNormalizerDummy();
+        $normalizer->denormalize(
+            array('fooFoo' => 'foo', 'fooBar' => 'bar'),
+            __NAMESPACE__.'\Dummy',
+            'any',
+            array('allow_extra_attributes' => false)
+        );
+    }
 }
 
 class AbstractObjectNormalizerDummy extends AbstractObjectNormalizer

Original file line number	Diff line number	Diff line change
`@@ -13,6 +13,7 @@`
`13`	`13`
`14`	`14`	`use Symfony\Component\PropertyAccess\Exception\InvalidArgumentException;`
`15`	`15`	`use Symfony\Component\Serializer\Exception\CircularReferenceException;`
	`16`	`+use Symfony\Component\Serializer\Exception\ExtraAttributesException;`
`16`	`17`	`use Symfony\Component\Serializer\Exception\LogicException;`
`17`	`18`	`use Symfony\Component\Serializer\Exception\UnexpectedValueException;`
`18`	`19`	`use Symfony\Component\PropertyInfo\PropertyTypeExtractorInterface;`
`@@ -171,8 +172,10 @@ public function denormalize($data, $class, $format = null, array $context = arra`
`171`	`172`	`if (!isset($context['cache_key'])) {`
`172`	`173`	`$context['cache_key'] = $this->getCacheKey($format, $context);`
`173`	`174`	`}`
	`175`	`+`
`174`	`176`	`$allowedAttributes = $this->getAllowedAttributes($class, $context, true);`
`175`	`177`	`$normalizedData = $this->prepareForDenormalization($data);`
	`178`	`+ $extraAttributes = array();`
`176`	`179`
`177`	`180`	`$reflectionClass = new \ReflectionClass($class);`
`178`	`181`	`$object = $this->instantiateObject($normalizedData, $class, $context, $reflectionClass, $allowedAttributes, $format);`
`@@ -183,6 +186,10 @@ public function denormalize($data, $class, $format = null, array $context = arra`
`183`	`186`	`}`
`184`	`187`
`185`	`188`	`if (($allowedAttributes !== false && !in_array($attribute, $allowedAttributes)) \|\| !$this->isAllowedAttribute($class, $attribute, $format, $context)) {`
	`189`	`+ if (isset($context['allow_extra_attributes']) && !$context['allow_extra_attributes']) {`
	`190`	`+ $extraAttributes[] = $attribute;`
	`191`	`+ }`
	`192`	`+`
`186`	`193`	`continue;`
`187`	`194`	`}`
`188`	`195`
`@@ -194,6 +201,10 @@ public function denormalize($data, $class, $format = null, array $context = arra`
`194`	`201`	`}`
`195`	`202`	`}`
`196`	`203`
	`204`	`+ if (!empty($extraAttributes)) {`
	`205`	`+ throw new ExtraAttributesException($extraAttributes);`
	`206`	`+ }`
	`207`	`+`
`197`	`208`	`return $object;`
`198`	`209`	`}`
`199`	`210`