bug #41491 [Serializer] Do not allow to denormalize string with spaces only to valid a DateTime object (sidz)

nicolas-grekas · nicolas-grekas · commit 3524cf28acaa · 2021-06-04T13:50:59.000+02:00
This PR was squashed before being merged into the 4.4 branch. Discussion ---------- [Serializer] Do not allow to denormalize string with spaces only to valid a DateTime object | Q | A | ------------- | --- | Branch? |4.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | N/A | License | MIT This PR fixes an issue when `$data` variable contains only spaces. In this case DateTimeNormalizer creates a DateTime object. Commits ------- 21c0829 [Serializer] Do not allow to denormalize string with spaces only to valid a DateTime object
diff --git a/src/Symfony/Component/Serializer/Normalizer/DateTimeNormalizer.php b/src/Symfony/Component/Serializer/Normalizer/DateTimeNormalizer.php
@@ -97,7 +97,7 @@ public function denormalize($data, $type, $format = null, array $context = [])
         $dateTimeFormat = $context[self::FORMAT_KEY] ?? null;
         $timezone = $this->getTimezone($context);
 
-        if ('' === $data || null === $data) {
+        if (null === $data || (\is_string($data) && '' === trim($data))) {
             throw new NotNormalizableValueException('The data is either an empty string or null, you should pass a string that can be parsed with the passed format or a valid DateTime string.');
         }
 
diff --git a/src/Symfony/Component/Serializer/Tests/Normalizer/DateTimeNormalizerTest.php b/src/Symfony/Component/Serializer/Tests/Normalizer/DateTimeNormalizerTest.php
@@ -201,6 +201,7 @@ public function testDenormalize()
         $this->assertEquals(new \DateTimeImmutable('2016/01/01', new \DateTimeZone('UTC')), $this->normalizer->denormalize('2016-01-01T00:00:00+00:00', \DateTimeInterface::class));
         $this->assertEquals(new \DateTimeImmutable('2016/01/01', new \DateTimeZone('UTC')), $this->normalizer->denormalize('2016-01-01T00:00:00+00:00', \DateTimeImmutable::class));
         $this->assertEquals(new \DateTime('2016/01/01', new \DateTimeZone('UTC')), $this->normalizer->denormalize('2016-01-01T00:00:00+00:00', \DateTime::class));
+        $this->assertEquals(new \DateTime('2016/01/01', new \DateTimeZone('UTC')), $this->normalizer->denormalize('  2016-01-01T00:00:00+00:00  ', \DateTime::class));
     }
 
     public function testDenormalizeUsingTimezonePassedInConstructor()
@@ -290,6 +291,20 @@ public function testDenormalizeEmptyStringThrowsException()
         $this->normalizer->denormalize('', \DateTimeInterface::class);
     }
 
+    public function testDenormalizeStringWithSpacesOnlyThrowsAnException()
+    {
+        $this->expectException(UnexpectedValueException::class);
+        $this->expectExceptionMessage('The data is either an empty string or null, you should pass a string that can be parsed with the passed format or a valid DateTime string.');
+        $this->normalizer->denormalize('  ', \DateTimeInterface::class);
+    }
+
+    public function testDenormalizeDateTimeStringWithSpacesUsingFormatPassedInContextThrowsAnException()
+    {
+        $this->expectException(UnexpectedValueException::class);
+        $this->expectExceptionMessage("Parsing datetime string \"  2016.01.01  \" using format \"Y.m.d|\" resulted in 2 errors: \nat position 0: Unexpected data found.\nat position 12: Trailing data");
+        $this->normalizer->denormalize('  2016.01.01  ', \DateTime::class, null, [DateTimeNormalizer::FORMAT_KEY => 'Y.m.d|']);
+    }
+
     public function testDenormalizeFormatMismatchThrowsException()
     {
         $this->expectException(UnexpectedValueException::class);

Original file line number	Diff line number	Diff line change
`@@ -97,7 +97,7 @@ public function denormalize($data, $type, $format = null, array $context = [])`
`97`	`97`	`$dateTimeFormat = $context[self::FORMAT_KEY] ?? null;`
`98`	`98`	`$timezone = $this->getTimezone($context);`
`99`	`99`
`100`		`- if ('' === $data \|\| null === $data) {`
	`100`	`+ if (null === $data \|\| (\is_string($data) && '' === trim($data))) {`
`101`	`101`	`throw new NotNormalizableValueException('The data is either an empty string or null, you should pass a string that can be parsed with the passed format or a valid DateTime string.');`
`102`	`102`	`}`
`103`	`103`