bug #18949 [3.1][Security] Fix DebugAccessDecisionManager when object is not a scalar (romainneutron)

fabpot · fabpot · commit 60b83dc2fece · 2016-06-03T07:23:02.000+02:00
This PR was merged into the 3.1 branch. Discussion ---------- [3.1][Security] Fix DebugAccessDecisionManager when object is not a scalar | Q | A | ------------- | --- | Branch? | 3.1 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | N/A | License | MIT Commits ------- ff2d189 [Security] Fix DebugAccessDecisionManager when object is not a scalar
diff --git a/src/Symfony/Component/Security/Core/Authorization/DebugAccessDecisionManager.php b/src/Symfony/Component/Security/Core/Authorization/DebugAccessDecisionManager.php
@@ -103,7 +103,14 @@ private function getStringRepresentation($object)
         }
 
         if (!is_object($object)) {
-            return sprintf('%s (%s)', gettype($object), $object);
+            if (is_bool($object)) {
+                return sprintf('%s (%s)', gettype($object), $object ? 'true' : 'false');
+            }
+            if (is_scalar($object)) {
+                return sprintf('%s (%s)', gettype($object), $object);
+            }
+
+            return gettype($object);
         }
 
         $objectClass = class_exists('Doctrine\Common\Util\ClassUtils') ? ClassUtils::getClass($object) : get_class($object);
diff --git a/src/Symfony/Component/Security/Core/Tests/Authorization/DebugAccessDecisionManagerTest.php b/src/Symfony/Component/Security/Core/Tests/Authorization/DebugAccessDecisionManagerTest.php
@@ -0,0 +1,43 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Tests\Authorization;
+
+use Symfony\Component\Security\Core\Authorization\AccessDecisionManager;
+use Symfony\Component\Security\Core\Authorization\DebugAccessDecisionManager;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+
+class DebugAccessDecisionManagerTest extends \PHPUnit_Framework_TestCase
+{
+    /**
+     * @dataProvider provideObjectsAndLogs
+     */
+    public function testDecideLog($expectedLog, $object)
+    {
+        $adm = new DebugAccessDecisionManager(new AccessDecisionManager());
+        $adm->decide($this->getMock(TokenInterface::class), array('ATTRIBUTE_1'), $object);
+
+        $this->assertSame($expectedLog, $adm->getDecisionLog());
+    }
+
+    public function provideObjectsAndLogs()
+    {
+        $object = new \stdClass();
+
+        yield array(array(array('attributes' => array('ATTRIBUTE_1'), 'object' => 'NULL', 'result' => false)), null);
+        yield array(array(array('attributes' => array('ATTRIBUTE_1'), 'object' => 'boolean (true)', 'result' => false)), true);
+        yield array(array(array('attributes' => array('ATTRIBUTE_1'), 'object' => 'string (jolie string)', 'result' => false)), 'jolie string');
+        yield array(array(array('attributes' => array('ATTRIBUTE_1'), 'object' => 'integer (12345)', 'result' => false)), 12345);
+        yield array(array(array('attributes' => array('ATTRIBUTE_1'), 'object' => 'resource', 'result' => false)), fopen(__FILE__, 'r'));
+        yield array(array(array('attributes' => array('ATTRIBUTE_1'), 'object' => 'array', 'result' => false)), array());
+        yield array(array(array('attributes' => array('ATTRIBUTE_1'), 'object' => sprintf('stdClass (object hash: %s)', spl_object_hash($object)), 'result' => false)), $object);
+    }
+}

Original file line number	Diff line number	Diff line change
`@@ -103,7 +103,14 @@ private function getStringRepresentation($object)`
`103`	`103`	`}`
`104`	`104`
`105`	`105`	`if (!is_object($object)) {`
`106`		`- return sprintf('%s (%s)', gettype($object), $object);`
	`106`	`+ if (is_bool($object)) {`
	`107`	`+ return sprintf('%s (%s)', gettype($object), $object ? 'true' : 'false');`
	`108`	`+ }`
	`109`	`+ if (is_scalar($object)) {`
	`110`	`+ return sprintf('%s (%s)', gettype($object), $object);`
	`111`	`+ }`
	`112`	`+`
	`113`	`+ return gettype($object);`
`107`	`114`	`}`
`108`	`115`
`109`	`116`	`$objectClass = class_exists('Doctrine\Common\Util\ClassUtils') ? ClassUtils::getClass($object) : get_class($object);`