bug #57305 [Validator] do not modify a constraint during validation to not leak its context (xabbuh)

fabpot · fabpot · commit 332b6f040bb7 · 2024-06-04T08:23:45.000+02:00
This PR was merged into the 7.1 branch. Discussion ---------- [Validator] do not modify a constraint during validation to not leak its context | Q | A | ------------- | --- | Branch? | 7.1 | Bug fix? | yes | New feature? | no | Deprecations? | no | Issues | Fix #57301 | License | MIT Commits ------- 34c12b7 do not modify a constraint during validation to not leak its context
diff --git a/src/Symfony/Component/Validator/Constraints/CidrValidator.php b/src/Symfony/Component/Validator/Constraints/CidrValidator.php
@@ -71,11 +71,13 @@ public function validate($value, Constraint $constraint): void
             return;
         }
 
-        if (filter_var($ipAddress, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV4) && $constraint->netmaskMax > 32) {
-            $constraint->netmaskMax = 32;
+        $netmaskMax = $constraint->netmaskMax;
+
+        if (filter_var($ipAddress, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV4) && $netmaskMax > 32) {
+            $netmaskMax = 32;
         }
 
-        if ($netmask < $constraint->netmaskMin || $netmask > $constraint->netmaskMax) {
+        if ($netmask < $constraint->netmaskMin || $netmask > $netmaskMax) {
             $this->context
                 ->buildViolation($constraint->netmaskRangeViolationMessage)
                 ->setParameter('{{ min }}', $constraint->netmaskMin)
diff --git a/src/Symfony/Component/Validator/Tests/Constraints/CidrValidatorTest.php b/src/Symfony/Component/Validator/Tests/Constraints/CidrValidatorTest.php
@@ -255,4 +255,17 @@ public static function getWithWrongVersion(): array
             ['2001:0db8:85a3:0000:0000:8a2e:0370:7334/13', Ip::V4],
         ];
     }
+
+    public function testDoesNotModifyContextBetweenValidations()
+    {
+        $constraint = new Cidr();
+
+        $this->validator->validate('1.2.3.4/28', $constraint);
+
+        $this->assertNoViolation();
+
+        $this->validator->validate('::1/64', $constraint);
+
+        $this->assertNoViolation();
+    }
 }
