[Security] Centralize max username length enforcement

chalasr · chalasr · commit b1520c269fe9 · 2022-06-08T00:24:29.000+02:00
diff --git a/src/Symfony/Component/Security/Core/Security.php b/src/Symfony/Component/Security/Core/Security.php
@@ -46,9 +46,7 @@ class Security implements AuthorizationCheckerInterface
     public const LAST_USERNAME = '_security.last_username';
 
     /**
-     * @deprecated since Symfony 6.2, use \Symfony\Component\Security\Http\Authenticator\AuthenticatorInterface::MAX_USERNAME_LENGTH instead
-     *
-     *  In 7.0, move this constant to the NewSecurityHelper class and make it reference AuthenticatorInterface:MAX_USERNAME_LENGTH.
+     * @deprecated since Symfony 6.2, use \Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge::MAX_USERNAME_LENGTH instead
      */
     public const MAX_USERNAME_LENGTH = 4096;
 
diff --git a/src/Symfony/Component/Security/Http/Authenticator/FormLoginAuthenticator.php b/src/Symfony/Component/Security/Http/Authenticator/FormLoginAuthenticator.php
@@ -132,10 +132,6 @@ private function getCredentials(Request $request): array
 
         $credentials['username'] = trim($credentials['username']);
 
-        if (\strlen($credentials['username']) > self::MAX_USERNAME_LENGTH) {
-            throw new BadCredentialsException('Invalid username.');
-        }
-
         $request->getSession()->set(SecurityRequestAttributes::LAST_USERNAME, $credentials['username']);
 
         return $credentials;
diff --git a/src/Symfony/Component/Security/Http/Authenticator/JsonLoginAuthenticator.php b/src/Symfony/Component/Security/Http/Authenticator/JsonLoginAuthenticator.php
@@ -149,10 +149,6 @@ private function getCredentials(Request $request)
             if (!\is_string($credentials['username'])) {
                 throw new BadRequestHttpException(sprintf('The key "%s" must be a string.', $this->options['username_path']));
             }
-
-            if (\strlen($credentials['username']) > self::MAX_USERNAME_LENGTH) {
-                throw new BadCredentialsException('Invalid username.');
-            }
         } catch (AccessException $e) {
             throw new BadRequestHttpException(sprintf('The key "%s" must be provided.', $this->options['username_path']), $e);
         }
diff --git a/src/Symfony/Component/Security/Http/Tests/Authenticator/FormLoginAuthenticatorTest.php b/src/Symfony/Component/Security/Http/Tests/Authenticator/FormLoginAuthenticatorTest.php
@@ -19,10 +19,10 @@
 use Symfony\Component\Security\Core\User\InMemoryUserProvider;
 use Symfony\Component\Security\Http\Authentication\AuthenticationFailureHandlerInterface;
 use Symfony\Component\Security\Http\Authentication\AuthenticationSuccessHandlerInterface;
-use Symfony\Component\Security\Http\Authenticator\AuthenticatorInterface;
 use Symfony\Component\Security\Http\Authenticator\FormLoginAuthenticator;
 use Symfony\Component\Security\Http\Authenticator\Passport\Badge\CsrfTokenBadge;
 use Symfony\Component\Security\Http\Authenticator\Passport\Badge\PasswordUpgradeBadge;
+use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
 use Symfony\Component\Security\Http\HttpUtils;
 use Symfony\Component\Security\Http\Tests\Authenticator\Fixtures\PasswordUpgraderProvider;
 
@@ -50,7 +50,7 @@ public function testHandleWhenUsernameLength($username, $ok)
             $this->expectNotToPerformAssertions();
         } else {
             $this->expectException(BadCredentialsException::class);
-            $this->expectExceptionMessage('Invalid username.');
+            $this->expectExceptionMessage('Username too long.');
         }
 
         $request = Request::create('/login_check', 'POST', ['_username' => $username, '_password' => 's$cr$t']);
@@ -62,8 +62,8 @@ public function testHandleWhenUsernameLength($username, $ok)
 
     public function provideUsernamesForLength()
     {
-        yield [str_repeat('x', AuthenticatorInterface::MAX_USERNAME_LENGTH + 1), false];
-        yield [str_repeat('x', AuthenticatorInterface::MAX_USERNAME_LENGTH - 1), true];
+        yield [str_repeat('x', UserBadge::MAX_USERNAME_LENGTH + 1), false];
+        yield [str_repeat('x', UserBadge::MAX_USERNAME_LENGTH - 1), true];
     }
 
     /**
diff --git a/src/Symfony/Component/Security/Http/Tests/Authenticator/JsonLoginAuthenticatorTest.php b/src/Symfony/Component/Security/Http/Tests/Authenticator/JsonLoginAuthenticatorTest.php
@@ -19,6 +19,7 @@
 use Symfony\Component\Security\Core\User\InMemoryUserProvider;
 use Symfony\Component\Security\Http\Authenticator\AuthenticatorInterface;
 use Symfony\Component\Security\Http\Authenticator\JsonLoginAuthenticator;
+use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
 use Symfony\Component\Security\Http\Authenticator\Passport\Credentials\PasswordCredentials;
 use Symfony\Component\Security\Http\HttpUtils;
 use Symfony\Component\Translation\Loader\ArrayLoader;
@@ -121,9 +122,9 @@ public function provideInvalidAuthenticateData()
         $request = new Request([], [], [], [], [], ['HTTP_CONTENT_TYPE' => 'application/json'], '{"username": "dunglas", "password": 1}');
         yield [$request, 'The key "password" must be a string.'];
 
-        $username = str_repeat('x', AuthenticatorInterface::MAX_USERNAME_LENGTH + 1);
-        $request = new Request([], [], [], [], [], ['HTTP_CONTENT_TYPE' => 'application/json'], sprintf('{"username": "%s", "password": 1}', $username));
-        yield [$request, 'Invalid username.', BadCredentialsException::class];
+        $username = str_repeat('x', UserBadge::MAX_USERNAME_LENGTH + 1);
+        $request = new Request([], [], [], [], [], ['HTTP_CONTENT_TYPE' => 'application/json'], sprintf('{"username": "%s", "password": "foo"}', $username));
+        yield [$request, 'Username too long.', BadCredentialsException::class];
     }
 
     public function testAuthenticationFailureWithoutTranslator()

Original file line number	Diff line number	Diff line change
`@@ -149,10 +149,6 @@ private function getCredentials(Request $request)`
`149`	`149`	`if (!\is_string($credentials['username'])) {`
`150`	`150`	`throw new BadRequestHttpException(sprintf('The key "%s" must be a string.', $this->options['username_path']));`
`151`	`151`	`}`
`152`		`-`
`153`		`- if (\strlen($credentials['username']) > self::MAX_USERNAME_LENGTH) {`
`154`		`- throw new BadCredentialsException('Invalid username.');`
`155`		`- }`
`156`	`152`	`} catch (AccessException $e) {`
`157`	`153`	`throw new BadRequestHttpException(sprintf('The key "%s" must be provided.', $this->options['username_path']), $e);`
`158`	`154`	`}`