Fix the 'supports' method argument type of the security voter

francoispluchino · francoispluchino · commit 73ce604b0c1a · 2020-06-18T10:19:58.000+02:00
diff --git a/src/Symfony/Component/Security/Core/Authorization/Voter/Voter.php b/src/Symfony/Component/Security/Core/Authorization/Voter/Voter.php
@@ -30,7 +30,7 @@ public function vote(TokenInterface $token, $subject, array $attributes)
         $vote = self::ACCESS_ABSTAIN;
 
         foreach ($attributes as $attribute) {
-            if (!$this->supports($attribute, $subject)) {
+            if (!\is_string($attribute) || !$this->supports($attribute, $subject)) {
                 continue;
             }
 
diff --git a/src/Symfony/Component/Security/Core/Tests/Authorization/Voter/VoterTest.php b/src/Symfony/Component/Security/Core/Tests/Authorization/Voter/VoterTest.php
@@ -43,6 +43,8 @@ public function getTests()
             [['EDIT'], VoterInterface::ACCESS_ABSTAIN, null, 'ACCESS_ABSTAIN if object is null'],
 
             [[], VoterInterface::ACCESS_ABSTAIN, new \stdClass(), 'ACCESS_ABSTAIN if no attributes were provided'],
+
+            [[new \stdClass()], VoterInterface::ACCESS_ABSTAIN, new \stdClass(), 'ACCESS_ABSTAIN if attributes were not strings'],
         ];
     }
 

Original file line number	Diff line number	Diff line change
`@@ -30,7 +30,7 @@ public function vote(TokenInterface $token, $subject, array $attributes)`
`30`	`30`	`$vote = self::ACCESS_ABSTAIN;`
`31`	`31`
`32`	`32`	`foreach ($attributes as $attribute) {`
`33`		`- if (!$this->supports($attribute, $subject)) {`
	`33`	`+ if (!\is_string($attribute) \|\| !$this->supports($attribute, $subject)) {`
`34`	`34`	`continue;`
`35`	`35`	`}`
`36`	`36`
Original file line number	Diff line number	Diff line change
`@@ -43,6 +43,8 @@ public function getTests()`
`43`	`43`	`[['EDIT'], VoterInterface::ACCESS_ABSTAIN, null, 'ACCESS_ABSTAIN if object is null'],`
`44`	`44`
`45`	`45`	`[[], VoterInterface::ACCESS_ABSTAIN, new \stdClass(), 'ACCESS_ABSTAIN if no attributes were provided'],`
	`46`	`+`
	`47`	`+ [[new \stdClass()], VoterInterface::ACCESS_ABSTAIN, new \stdClass(), 'ACCESS_ABSTAIN if attributes were not strings'],`
`46`	`48`	`];`
`47`	`49`	`}`
`48`	`50`