[Validator][RecursiveContextualValidator] Prevent validated hash collisions

fancyweb · fancyweb · commit f8cea763f408 · 2020-04-10T16:44:27.000+02:00
diff --git a/src/Symfony/Component/Validator/Tests/Validator/RecursiveValidatorTest.php b/src/Symfony/Component/Validator/Tests/Validator/RecursiveValidatorTest.php
@@ -12,13 +12,16 @@
 namespace Symfony\Component\Validator\Tests\Validator;
 
 use Symfony\Component\Translation\IdentityTranslator;
+use Symfony\Component\Validator\Constraint;
 use Symfony\Component\Validator\Constraints\All;
 use Symfony\Component\Validator\Constraints\Collection;
 use Symfony\Component\Validator\Constraints\GroupSequence;
+use Symfony\Component\Validator\Constraints\IsFalse;
 use Symfony\Component\Validator\Constraints\IsTrue;
 use Symfony\Component\Validator\Constraints\Length;
 use Symfony\Component\Validator\Constraints\NotBlank;
 use Symfony\Component\Validator\Constraints\NotNull;
+use Symfony\Component\Validator\ConstraintValidator;
 use Symfony\Component\Validator\ConstraintValidatorFactory;
 use Symfony\Component\Validator\Context\ExecutionContextFactory;
 use Symfony\Component\Validator\Mapping\ClassMetadata;
@@ -157,4 +160,36 @@ public function testAllConstraintValidateAllGroupsForNestedConstraints()
         $this->assertInstanceOf(NotBlank::class, $violations->get(0)->getConstraint());
         $this->assertInstanceOf(Length::class, $violations->get(1)->getConstraint());
     }
+
+    public function testValidatedConstraintsHashesDontCollide()
+    {
+        $entity = new Entity();
+        $entity->data = new \stdClass();
+
+        $this->assertSame(1, $this->validator->validate($entity, new TestConstraintHashesDontCollide())->count());
+    }
+}
+
+final class TestConstraintHashesDontCollide extends Constraint
+{
+}
+
+final class TestConstraintHashesDontCollideValidator extends ConstraintValidator
+{
+    /**
+     * {@inheritdoc}
+     */
+    public function validate($value, Constraint $constraint)
+    {
+        if (!$value instanceof Entity) {
+            throw new \LogicException();
+        }
+
+        $this->context->getValidator()
+            ->inContext($this->context)
+            ->atPath('data')
+            ->validate($value, new NotNull())
+            ->validate($value, new NotNull())
+            ->validate($value, new IsFalse());
+    }
 }
diff --git a/src/Symfony/Component/Validator/Validator/RecursiveContextualValidator.php b/src/Symfony/Component/Validator/Validator/RecursiveContextualValidator.php
@@ -48,6 +48,10 @@ class RecursiveContextualValidator implements ContextualValidatorInterface
     private $validatorFactory;
     private $objectInitializers;
 
+    private $validatedObjectsReferences = [];
+    private $validatedConstraintsReferences = [];
+    private $initializedObjectsReferences = [];
+
     /**
      * Creates a validator for the given context.
      *
@@ -442,6 +446,10 @@ private function validateClassNode($object, $cacheKey, ClassMetadataInterface $m
     {
         $context->setNode($object, $object, $metadata, $propertyPath);
 
+        if (!isset($this->initializedObjectsReferences[$cacheKey])) {
+            $this->initializedObjectsReferences[$cacheKey] = $object;
+        }
+
         if (!$context->isObjectInitialized($cacheKey)) {
             foreach ($this->objectInitializers as $initializer) {
                 $initializer->initialize($object);
@@ -457,7 +465,15 @@ private function validateClassNode($object, $cacheKey, ClassMetadataInterface $m
             $defaultOverridden = false;
 
             // Use the object hash for group sequences
-            $groupHash = \is_object($group) ? spl_object_hash($group) : $group;
+            if (\is_object($group)) {
+                $groupHash = spl_object_hash($group);
+
+                if (!isset($this->validatedObjectsReferences[$groupHash])) {
+                    $this->validatedObjectsReferences[$groupHash] = $group;
+                }
+            } else {
+                $groupHash = $group;
+            }
 
             if ($context->isGroupValidated($cacheKey, $groupHash)) {
                 // Skip this group when validating the properties and when
@@ -790,6 +806,10 @@ private function validateInGroup($value, $cacheKey, MetadataInterface $metadata,
             // that constraints belong to multiple validated groups
             if (null !== $cacheKey) {
                 $constraintHash = spl_object_hash($constraint);
+                if (!isset($this->validatedConstraintsReferences[$constraintHash])) {
+                    $this->validatedConstraintsReferences[$constraintHash] = $constraint;
+                }
+
                 // instanceof Valid: In case of using a Valid constraint with many groups
                 // it makes a reference object get validated by each group
                 if ($constraint instanceof Composite || $constraint instanceof Valid) {
