[Security] Fixed roles serialization on token from user object #19778

eko · 2016-08-29T18:44:15Z

Q	A
Branch?	2.7
Bug fix?	yes
New feature?	no
BC breaks?	no
Deprecations?	no
Tests pass?	yes
Fixed tickets	#14274
License	MIT
Doc PR	-

This PR fixes the serialization of tokens when using Role objects provided from the user. Indeed, there were actually a reference issue that can causes fatal errors like the following one:

FatalErrorException in RoleHierarchy.php line 43:
Error: Call to a member function getRole() on string

Here is a small code example to reproduce and its output:

$user = new Symfony\Component\Security\Core\User\User('name', 'password', [
    new Symfony\Component\Security\Core\Role\Role('name')
]);
$token = new Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken($user, 'password', 'providerKey', $user->getRoles());

$serialized = serialize($token);
$unserialized = unserialize($serialized);

var_dump($unserialized->getRoles());

Before:

array(1) { [0]=> bool(true) }

After:

array(1) { [0]=> object(Symfony\Component\Security\Core\Role\Role)#15 (1) {["role":"Symfony\Component\Security\Core\Role\Role":private]=> string(4) "name" } }

Thank you

ro0NL · 2016-09-18T18:32:04Z

src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php

@@ -46,7 +46,7 @@ public function __construct(array $roles = array())
                throw new \InvalidArgumentException(sprintf('$roles must be an array of strings, or RoleInterface instances, but got %s.', gettype($role)));
            }

-            $this->roles[] = $role;
+            $this->roles[] = clone $role;


Why not do the cloning in serialize() like the user object?

@ro0NL Because in the serialize() method, we have $this->roles which is an array, not an object (cannot be cloned).

Understand.. i also meant: clone the array and each object in it. array_map(function($role) { return clone $role; }, $roles)

@ro0NL Alright, this is updated according to your comment.

ro0NL · 2016-09-18T18:43:31Z

...ony/Component/Security/Core/Tests/Authentication/Provider/UserAuthenticationProviderTest.php

@@ -220,7 +220,7 @@ public function testAuthenticateWithPreservingRoleSwitchUserRole()
        $this->assertInstanceOf('Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken', $authToken);
        $this->assertSame($user, $authToken->getUser());
        $this->assertContains(new Role('ROLE_FOO'), $authToken->getRoles(), '', false, false);
-        $this->assertContains($switchUserRole, $authToken->getRoles());
+        $this->assertContains($switchUserRole, $authToken->getRoles(), '', false, false);


Is this related?

@ro0NL Yes, it is related, test failed without that change because we checked an exact reference. Check has to be changed like the line just before.

ro0NL · 2016-09-18T18:50:43Z

src/Symfony/Component/Security/Core/Tests/Authentication/Token/AbstractTokenTest.php

@@ -96,6 +97,19 @@ public function testSerialize()
        $this->assertEquals($token->getAttributes(), $uToken->getAttributes());
    }

+    public function testSerializeWithRoleObjects()


Better update AbstractTokenTest::testSerialize with a 2nd role as object instead of all these duplicated tests.

@ro0NL I agree with you on this comment, I will remove all of these tests and just let one into AbstractTokenTest to avoid adding a lot of tests. Thanks

This is done, PR is up-to-date with comments.

Why not update testSerialize? Ie. L91 => $token = $this->getToken(array('ROLE_FOO', new Role('ROLE_BAR'));

@ro0NL I've updated the testSerialize test with a second role that is from user entity (even if it were already working in this case).
The issue here was when the roles are the same reference as the ones in the user entity.

Your change is covered by the test above now.

The issue here was when the roles are the same reference as the ones in the user entity.

Im not sure how that relates to your change... what about adding a $token->setUser($mockedUser) to above test so AbstractToken::serialize() is fully covered.

@ro0NL Roles are passed in the AbstractToken::__construct() when coming from the user: https://github.com/eko/symfony/blob/dfa7f5020e1274870ee815bb536d37b0e61d8046/src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php#L40

eko · 2016-09-26T19:04:59Z

@ro0NL Thank you for taking time to review this PR, is it ok for you?

ro0NL · 2016-09-26T19:46:50Z

src/Symfony/Component/Security/Core/Tests/Authentication/Token/AbstractTokenTest.php

@@ -87,7 +88,7 @@ public function testEraseCredentials()

    public function testSerialize()
    {
-        $token = $this->getToken(array('ROLE_FOO'));


What about

$user = new User('name', 'password', array('ROLE_FOO', new Role('ROLE_BAR'))); $token = $this->getToken(array('ROLE_FOO2', new Role('ROLE_BAR2'))); $token->setUser($user); // serialize/unserialize $this->assertEquals($token->getUser(), $uToken->getUser());

Fully covers AbstractToken::(un)serialize and no need for the test below.

ro0NL · 2016-09-26T19:54:16Z

src/Symfony/Component/Security/Core/Tests/Authentication/Token/AbstractTokenTest.php

+    public function testSerializeWithRoleObjects()
+    {
+        $user = new User('name', 'password', array(new Role('ROLE_FOO'), new Role('ROLE_BAR')));
+        $token = new ConcreteToken($user, $user->getRoles());


Point is; passing roles here is effectively the same as passing in roles via $this->getToken($roles).. like above.

ro0NL · 2016-09-26T19:56:31Z

src/Symfony/Component/Security/Core/Tests/Authentication/Token/AbstractTokenTest.php

+
+        $roles = $unserialized->getRoles();
+
+        $this->assertEquals($roles, $user->getRoles());


Same test as above, ie. $this->assertEquals($token->getRoles(), $uToken->getRoles());

ro0NL · 2016-12-20T15:48:03Z

Still think tests can be combined, but other then that this is good 👍

Status: Reviewed

fabpot · 2017-03-22T21:45:50Z

Thank you @eko.

…ject (eko) This PR was merged into the 2.7 branch. Discussion ---------- [Security] Fixed roles serialization on token from user object | Q | A | | --- | --- | | Branch? | 2.7 | | Bug fix? | yes | | New feature? | no | | BC breaks? | no | | Deprecations? | no | | Tests pass? | yes | | Fixed tickets | #14274 | | License | MIT | | Doc PR | - | This PR fixes the serialization of tokens when using `Role` objects provided from the user. Indeed, there were actually a reference issue that can causes fatal errors like the following one: ``` FatalErrorException in RoleHierarchy.php line 43: Error: Call to a member function getRole() on string ``` Here is a small code example to reproduce and its output: ``` php $user = new Symfony\Component\Security\Core\User\User('name', 'password', [ new Symfony\Component\Security\Core\Role\Role('name') ]); $token = new Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken($user, 'password', 'providerKey', $user->getRoles()); $serialized = serialize($token); $unserialized = unserialize($serialized); var_dump($unserialized->getRoles()); ``` Before: ``` array(1) { [0]=> bool(true) } ``` After: ``` array(1) { [0]=> object(Symfony\Component\Security\Core\Role\Role)#15 (1) {["role":"Symfony\Component\Security\Core\Role\Role":private]=> string(4) "name" } } ``` Thank you Commits ------- dfa7f50 [Security] Fixed roles serialization on token from user object

carsonbot added Status: Needs Review Security Bug labels Aug 29, 2016

eko force-pushed the fix-role-serialization branch 2 times, most recently from 69a588f to f5f7021 Compare August 29, 2016 19:10

ro0NL reviewed Sep 18, 2016

View reviewed changes

eko force-pushed the fix-role-serialization branch 5 times, most recently from 94266ed to f21fb26 Compare September 20, 2016 07:36

[Security] Fixed roles serialization on token from user object

dfa7f50

eko force-pushed the fix-role-serialization branch from f21fb26 to dfa7f50 Compare September 21, 2016 14:33

ro0NL reviewed Sep 26, 2016

View reviewed changes

nicolas-grekas added this to the 2.7 milestone Dec 6, 2016

carsonbot added Status: Reviewed and removed Status: Needs Review labels Dec 20, 2016

fabpot merged commit dfa7f50 into symfony:2.7 Mar 22, 2017

This was referenced Apr 4, 2017

Release v2.7.26 #22263

Merged

Release v2.8.19 #22284

Merged

Release v3.2.7 #22293

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security] Fixed roles serialization on token from user object #19778

[Security] Fixed roles serialization on token from user object #19778

eko commented Aug 29, 2016 •

edited

Loading

ro0NL Sep 18, 2016

eko Sep 19, 2016

ro0NL Sep 19, 2016 •

edited

Loading

eko Sep 19, 2016

ro0NL Sep 18, 2016

eko Sep 19, 2016

ro0NL Sep 18, 2016 •

edited

Loading

eko Sep 19, 2016

eko Sep 20, 2016

ro0NL Sep 20, 2016

eko Sep 21, 2016

ro0NL Sep 21, 2016 •

edited

Loading

eko Sep 22, 2016

eko commented Sep 26, 2016

ro0NL Sep 26, 2016 •

edited

Loading

ro0NL Sep 26, 2016

ro0NL Sep 26, 2016

ro0NL commented Dec 20, 2016

fabpot commented Mar 22, 2017


		$roles = $unserialized->getRoles();

		$this->assertEquals($roles, $user->getRoles());

[Security] Fixed roles serialization on token from user object #19778

[Security] Fixed roles serialization on token from user object #19778

Conversation

eko commented Aug 29, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ro0NL Sep 19, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ro0NL Sep 18, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ro0NL Sep 21, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

eko commented Sep 26, 2016

ro0NL Sep 26, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ro0NL commented Dec 20, 2016

fabpot commented Mar 22, 2017

eko commented Aug 29, 2016 •

edited

Loading

ro0NL Sep 19, 2016 •

edited

Loading

ro0NL Sep 18, 2016 •

edited

Loading

ro0NL Sep 21, 2016 •

edited

Loading

ro0NL Sep 26, 2016 •

edited

Loading