Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 41000f1

Browse files
nicolas-grekasnicolas-grekas
committed
[Security] dont do nested calls to serialize()
1 parent afb7bb5 commit 41000f1

10 files changed

+38
-19
lines changed

‎src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php

Lines changed: 21 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -134,25 +134,24 @@ public function eraseCredentials()
134134

135135
/**
136136
* {@inheritdoc}
137+
*
138+
* @param bool $isCalledFromOverridingMethod Must be set to true when called from an overriding method
139+
*
140+
* @return string|array Returns an array when $isCalledFromOverridingMethod is set to true
137141
*/
138142
public function serialize()
139143
{
140-
return serialize(
141-
[
142-
\is_object($this->user) ? clone $this->user : $this->user,
143-
$this->authenticated,
144-
array_map(function ($role) { return clone $role; }, $this->roles),
145-
$this->attributes,
146-
]
147-
);
144+
$serialized = [$this->user, $this->authenticated, $this->roles, $this->attributes];
145+
146+
return $this->doSerialize($serialized, \func_num_args() ? \func_get_arg(0) : null);
148147
}
149148

150149
/**
151150
* {@inheritdoc}
152151
*/
153152
public function unserialize($serialized)
154153
{
155-
list($this->user, $this->authenticated, $this->roles, $this->attributes) = unserialize($serialized);
154+
list($this->user, $this->authenticated, $this->roles, $this->attributes) = \is_array($serialized) ? $serialized : unserialize($serialized);
156155
}
157156

158157
/**
@@ -232,6 +231,19 @@ public function __toString()
232231
return sprintf('%s(user="%s", authenticated=%s, roles="%s")', $class, $this->getUsername(), json_encode($this->authenticated), implode(', ', $roles));
233232
}
234233

234+
/**
235+
* @internal
236+
*/
237+
protected function doSerialize($serialized, $isCalledFromOverridingMethod)
238+
{
239+
if (null === $isCalledFromOverridingMethod) {
240+
$trace = debug_backtrace(DEBUG_BACKTRACE_PROVIDE_OBJECT, 3);
241+
$isCalledFromOverridingMethod = isset($trace[2]['function'], $trace[2]['object']) && 'serialize' === $trace[2]['function'] && $this === $trace[2]['object'];
242+
}
243+
244+
return $isCalledFromOverridingMethod ? $serialized : serialize($serialized);
245+
}
246+
235247
private function hasUserChanged(UserInterface $user)
236248
{
237249
if (!($this->user instanceof UserInterface)) {

‎src/Symfony/Component/Security/Core/Authentication/Token/AnonymousToken.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ public function serialize()
6767
*/
6868
public function unserialize($serialized)
6969
{
70-
list($this->secret, $parentStr) = unserialize($serialized);
70+
list($this->secret, $parentStr) = \is_array($serialized) ? $serialized : unserialize($serialized);
7171
parent::unserialize($parentStr);
7272
}
7373
}

‎src/Symfony/Component/Security/Core/Authentication/Token/PreAuthenticatedToken.php

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,18 +76,22 @@ public function eraseCredentials()
7676

7777
/**
7878
* {@inheritdoc}
79+
*
80+
* @param bool $isCalledFromOverridingMethod Must be set to true when called from an overriding method
7981
*/
8082
public function serialize()
8183
{
82-
return serialize([$this->credentials, $this->providerKey, parent::serialize()]);
84+
$serialized = [$this->credentials, $this->providerKey, parent::serialize(true)];
85+
86+
return $this->doSerialize($serialized, \func_num_args() ? \func_get_arg(0) : null);
8387
}
8488

8589
/**
8690
* {@inheritdoc}
8791
*/
8892
public function unserialize($str)
8993
{
90-
list($this->credentials, $this->providerKey, $parentStr) = unserialize($str);
94+
list($this->credentials, $this->providerKey, $parentStr) = \is_array($str) ? $str : unserialize($str);
9195
parent::unserialize($parentStr);
9296
}
9397
}

‎src/Symfony/Component/Security/Core/Authentication/Token/RememberMeToken.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ public function serialize()
106106
*/
107107
public function unserialize($serialized)
108108
{
109-
list($this->secret, $this->providerKey, $parentStr) = unserialize($serialized);
109+
list($this->secret, $this->providerKey, $parentStr) = \is_array($serialized) ? $serialized : unserialize($serialized);
110110
parent::unserialize($parentStr);
111111
}
112112
}

‎src/Symfony/Component/Security/Core/Authentication/Token/UsernamePasswordToken.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ public function serialize()
9999
*/
100100
public function unserialize($serialized)
101101
{
102-
list($this->credentials, $this->providerKey, $parentStr) = unserialize($serialized);
102+
list($this->credentials, $this->providerKey, $parentStr) = \is_array($serialized) ? $serialized : unserialize($serialized);
103103
parent::unserialize($parentStr);
104104
}
105105
}

‎src/Symfony/Component/Security/Core/Exception/AccountStatusException.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ public function serialize()
5555
*/
5656
public function unserialize($str)
5757
{
58-
list($this->user, $parentData) = unserialize($str);
58+
list($this->user, $parentData) = \is_array($str) ? $str : unserialize($str);
5959

6060
parent::unserialize($parentData);
6161
}

‎src/Symfony/Component/Security/Core/Exception/CustomUserMessageAuthenticationException.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ public function serialize()
7272
*/
7373
public function unserialize($str)
7474
{
75-
list($parentData, $this->messageKey, $this->messageData) = unserialize($str);
75+
list($parentData, $this->messageKey, $this->messageData) = \is_array($str) ? $str : unserialize($str);
7676

7777
parent::unserialize($parentData);
7878
}

‎src/Symfony/Component/Security/Core/Exception/UsernameNotFoundException.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ public function serialize()
6565
*/
6666
public function unserialize($str)
6767
{
68-
list($this->username, $parentData) = unserialize($str);
68+
list($this->username, $parentData) = \is_array($str) ? $str : unserialize($str);
6969

7070
parent::unserialize($parentData);
7171
}

‎src/Symfony/Component/Security/Core/Tests/Authentication/Token/AbstractTokenTest.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,9 @@ public function __construct($user, array $roles = [])
4343
$this->setUser($user);
4444
}
4545

46+
/**
47+
* @param bool $isCalledFromOverridingMethod Must be set to true when called from an overriding method
48+
*/
4649
public function serialize()
4750
{
4851
return serialize([$this->credentials, parent::serialize()]);

‎src/Symfony/Component/Security/Guard/Token/PostAuthenticationGuardToken.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,15 +76,15 @@ public function getProviderKey()
7676
*/
7777
public function serialize()
7878
{
79-
return serialize([$this->providerKey, parent::serialize()]);
79+
return serialize([$this->providerKey, parent::serialize(true)]);
8080
}
8181

8282
/**
8383
* {@inheritdoc}
8484
*/
8585
public function unserialize($serialized)
8686
{
87-
list($this->providerKey, $parentStr) = unserialize($serialized);
87+
list($this->providerKey, $parentStr) = \is_array($serialized) ? $serialized : unserialize($serialized);
8888
parent::unserialize($parentStr);
8989
}
9090
}

0 commit comments

Comments
 (0)