allow_extra_attributes does not throw an exception as documented #26534

deviantintegral · 2018-03-14T18:35:50Z

Q	A
Branch?	3.4
Bug fix?	yes
New feature?	no
BC breaks?	no
Deprecations?	no
Tests pass?	yes
Fixed tickets	none
License	MIT
Doc PR	none

The example at Deserializing an object does not actually work. It looks like this is a bug and not a docs issue. #24783 reported the same bug, but it looks like the fix at #24816 isn't complete.

Here's a failing test that copies the existing example.

ogizanagi · 2018-03-14T19:03:32Z

Hey @deviantintegral! Thanks for the report.

IIRC, this is not working because there is no metadata. allow_extra_attribute => false cannot work properly without metadata. Hence my fix was only fixing the case where the ObjectNormalizer was instantiated with a ClassMetadataFactoryInterface $classMetadataFactory argument.

Right now, I'm not sure if we can do something.

dunglas · 2018-03-15T16:21:01Z

We may throw if this flag is set but the metadata are not loaded. WDYT?

ogizanagi · 2018-03-15T16:56:34Z

Could be a solution indeed. Perhaps triggering a deprecation first and throwing on 5.0 if we fear this might break some apps (that would mean the flag wasn't working anyway and they didn't noticed, but an exception at runtime would be worse I think).

@deviantintegral: Would you like to work on this ?

dunglas · 2018-03-15T16:57:49Z

I would throw directly. Relying on a non-functional behavior like this one can lead to security vulnerabilities.

ogizanagi · 2018-03-15T18:08:53Z

But I don't see any security vulnerability here. If the flag is set without metadata factory, no ExtraAttributesException is raised but extra attributes will simply be ignored. This exception is only for convenience, no security purpose implied AFAIK.

Anyway, I'm fine with both.

deviantintegral · 2018-03-16T11:07:18Z

IIRC, this is not working because there is no metadata. allow_extra_attribute => false cannot work properly without metadata.

I'd expected that something was reflecting the target class, and looking for public properties or set methods. If neither of those existed for a given property in the data being deserialized, then an ExtraAttributesException would be thrown. I agree about the convenience factor; my aim was to use it only during early development to ensure that the data being deserialized matched the documentation provided to me.

Is there any reason why we couldn't instantiate a default metadata providing this behaviour, if allow_extra_attribute => false is set and no factory is provided?

nicolas-grekas · 2018-03-19T14:55:19Z

Status: needs work

deviantintegral · 2018-03-22T23:36:12Z

I see I need to add the legacy annotations or methods for exception tests. I will do that tomorrow.

One question; if I try to deserialize into a class that only has a private field specified, with no setter, it is not set, but no exception is thrown as it's still in the list of allowed attributes. Is there a decorator class I missed to do field access checks when reflecting the target class?

ogizanagi · 2018-03-23T07:17:13Z

src/Symfony/Component/Serializer/Tests/Normalizer/AbstractObjectNormalizerTest.php

+</person>
+EOF;
+
+        $encoders = array(new XmlEncoder());


No need for the xml encoder & serializer for this test. It's just about the object normalizer. See above one.

Good point. I used the full ObjectNormalizer class as I think we need it's implementations to reasonably test this. Should it be copied in as a dummy class or left as is?

This is fine with the ObjectNormalizer to me :)

ogizanagi · 2018-03-23T07:22:28Z

src/Symfony/Component/Serializer/Normalizer/AbstractNormalizer.php

+            // If additional attributes are not allowed, use a default class metadata factory to check against
+            // properties and methods.
+            if (isset($context[static::ALLOW_EXTRA_ATTRIBUTES]) && !$context[static::ALLOW_EXTRA_ATTRIBUTES]) {
+                $this->classMetadataFactory = new ClassMetadataFactory(new AnnotationLoader(new AnnotationReader()));


An issue I see with this might be performances, as there is no cache on contrary of the CacheClassMetadataFactory used on production. If that's only for a convenience exception, it's a free penalty.

We could default to an array cache, or we could leave it to the docs to say "if you are using allow_extra_attributes in production, consider caching the metadata factory". Thoughts?

Array cache wouldn't be useful actually. ClassMetadataFactory already has its own in memory cache. So the performances impact might not be really significant in most cases actually.

It's why I'm for throwing instead.
Everything else in the component works this way. If someone want to use this feature, it must register properly a metadata factory (and use a cached one as much as possible).

deviantintegral · 2018-03-26T11:39:59Z

Can someone rebuild the appveyor build? It threw Failed to decode response: zlib_decode(): data error 69 during composer update.

ogizanagi · 2018-03-26T11:55:15Z

@deviantintegral : Done.

nicolas-grekas · 2018-04-14T15:10:00Z

ping @ogizanagi @dunglas, any decision about throwing or not?

ogizanagi · 2018-04-14T15:38:39Z

Alright, considering #26534 (comment), let's throw.
I still see no security implications though, so we're able to trigger a deprecation to ensure it doesn't breaks any app thinking they're using the flag properly without metadata factory, but no strong opinion.

The documentation should also benefit from a PR.

dunglas · 2018-04-16T06:11:43Z

Perfect.

deviantintegral · 2018-05-04T21:30:19Z

The appveyor failure is in the Process component, so I'm guessing it's unrelated to this PR. This should be ready for another review.

fabpot · 2018-05-30T02:25:39Z

Something went wrong here. @deviantintegral Can you rebase on current 3.4?

deviantintegral · 2018-05-30T13:24:59Z

The test failures are from HttpKernel and are on the 3.4 branch too:

1) Symfony\Component\HttpKernel\Tests\Fragment\InlineFragmentRendererTest::testRenderWithTrustedHeaderDisabled
Expectation failed for method name is equal to "handle" when invoked 1 time(s)
Parameter 0 for invocation Symfony\Component\HttpKernel\HttpKernelInterface::handle(Symfony\Component\HttpFoundation\Request Object (...), 2, false) does not match expected value.
Failed asserting that two objects are equal.
--- Expected
+++ Actual
@@ @@
-            'REMOTE_ADDR' => '1.1.1.1'
+            'REMOTE_ADDR' => '127.0.0.1'

ogizanagi

@deviantintegral : Could you also submit a PR to the symfony-docs repository?
Would be great IMHO to add a note block to hint about this.

ogizanagi · 2018-05-30T18:03:38Z

src/Symfony/Component/Serializer/Normalizer/AbstractNormalizer.php

@@ -205,6 +205,10 @@ protected function handleCircularReference($object)
    protected function getAllowedAttributes($classOrObject, array $context, $attributesAsString = false)
    {
        if (!$this->classMetadataFactory) {
+            if (isset($context[static::ALLOW_EXTRA_ATTRIBUTES]) && !$context[static::ALLOW_EXTRA_ATTRIBUTES]) {
+                throw new LogicException('A class metadata factory must be provided in the constructor when setting ALLOW_EXTRA_ATTRIBUTES to false.');


Actually should rather use the ALLOW_EXTRA_ATTRIBUTE const value here I think.

Where is that constant defined? I don't see that anywhere in the project, at least on the 3.4 and 4.1 branches.

I mean static::ALLOW_EXTRA_ATTRIBUTES. the one used in the isset above ^^

Oh, I get it - the docs and so on don't use the class constant, but the actual lowercase string. I'll update.

That's why I asked for using the const value. Here you're mentioning the constant in the error message :)

nicolas-grekas · 2018-06-21T11:11:26Z

(rebase needed)

symfony/symfony#26534

deviantintegral · 2018-06-21T17:56:21Z

Docs PR filed at symfony/symfony-docs#9948

ogizanagi

Thanks @deviantintegral

ogizanagi · 2018-06-21T18:38:00Z

src/Symfony/Component/Serializer/Normalizer/AbstractNormalizer.php

@@ -208,7 +208,7 @@ protected function getAllowedAttributes($classOrObject, array $context, $attribu
    {
        if (!$this->classMetadataFactory) {
            if (isset($context[static::ALLOW_EXTRA_ATTRIBUTES]) && !$context[static::ALLOW_EXTRA_ATTRIBUTES]) {
-                throw new LogicException('A class metadata factory must be provided in the constructor when setting ALLOW_EXTRA_ATTRIBUTES to false.');
+                throw new LogicException(sprintf('A class metadata factory must be provided in the constructor when setting %s to false.', static::ALLOW_EXTRA_ATTRIBUTES));


Perhaps just wrapping the const value with double quotes

ogizanagi · 2018-06-21T20:02:27Z

Thanks @deviantintegral.

…mented (deviantintegral) This PR was squashed before being merged into the 3.4 branch (closes #26534). Discussion ---------- allow_extra_attributes does not throw an exception as documented | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | BC breaks? | no  | Deprecations? | no | Tests pass? | yes  | Fixed tickets | none | License | MIT | Doc PR | none The example at [Deserializing an object](https://symfony.com/doc/current/components/serializer.html#deserializing-an-object) does not actually work. It looks like this is a bug and not a docs issue. #24783 reported the same bug, but it looks like the fix at #24816 isn't complete. Here's a failing test that copies the existing example. Commits ------- a67b650 allow_extra_attributes does not throw an exception as documented

symfony/symfony#26534

…al, javiereguiluz) This PR was submitted for the master branch but it was merged into the 3.4 branch instead (closes #9948). Discussion ---------- Document the required ClassMetadataFactory Symfony PR at symfony/symfony#26534 Commits ------- bc011c0 Reword b05c1cc Codefence ClassMetadataFactory a4cb67a Document the required ClassMetadataFactory

symfony/symfony#26534

carsonbot added Status: Needs Review Bug labels Mar 14, 2018

nicolas-grekas added this to the 3.4 milestone Mar 15, 2018

carsonbot added Status: Needs Work and removed Status: Needs Review labels Mar 19, 2018

deviantintegral mentioned this pull request Mar 21, 2018

Initial media data object class Lullabot/mpx-php#40

Merged

ogizanagi reviewed Mar 23, 2018

View reviewed changes

deviantintegral force-pushed the extra-attributes branch 3 times, most recently from b4c6539 to e70ee3c Compare March 23, 2018 19:54

ogizanagi mentioned this pull request Apr 24, 2018

[serializer] allowed_extra_attributes doesn't throw Exception like docs says #27036

Closed

carsonbot added Status: Reviewed and removed Status: Needs Work labels May 5, 2018

ogizanagi approved these changes May 5, 2018

View reviewed changes

dunglas approved these changes May 29, 2018

View reviewed changes

fabpot force-pushed the extra-attributes branch from f1b581a to 60d6562 Compare May 30, 2018 02:21

deviantintegral requested a review from lyrixx as a code owner May 30, 2018 02:21

carsonbot added Status: Needs Review and removed Status: Reviewed labels May 30, 2018

ogizanagi added the Serializer label May 30, 2018

ogizanagi removed the request for review from lyrixx May 30, 2018 10:59

deviantintegral force-pushed the extra-attributes branch from 60d6562 to 4283e74 Compare May 30, 2018 12:30

ogizanagi added Status: Reviewed and removed Status: Needs Review labels May 30, 2018

ogizanagi reviewed May 30, 2018

View reviewed changes

deviantintegral force-pushed the extra-attributes branch 2 times, most recently from d878b4c to b594ad8 Compare June 21, 2018 17:48

deviantintegral added a commit to deviantintegral/symfony-docs that referenced this pull request Jun 21, 2018

Document the required ClassMetadataFactory

eb84068

symfony/symfony#26534

deviantintegral mentioned this pull request Jun 21, 2018

Document the required ClassMetadataFactory symfony/symfony-docs#9948

Closed

ogizanagi approved these changes Jun 21, 2018

View reviewed changes

allow_extra_attributes does not throw an exception as documented

a67b650

ogizanagi force-pushed the extra-attributes branch from 53283c4 to a67b650 Compare June 21, 2018 20:00

ogizanagi merged commit a67b650 into symfony:3.4 Jun 21, 2018

This was referenced Jun 25, 2018

Release v3.4.12 #27704

Merged

Release v4.0.12 #27705

Merged

Release v4.1.1 #27706

Merged

javiereguiluz pushed a commit to symfony/symfony-docs that referenced this pull request Jul 16, 2018

Document the required ClassMetadataFactory

a4cb67a

symfony/symfony#26534

Guikingone pushed a commit to Guikingone/symfony-docs that referenced this pull request Feb 12, 2019

Document the required ClassMetadataFactory

091367e

symfony/symfony#26534

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

allow_extra_attributes does not throw an exception as documented #26534

allow_extra_attributes does not throw an exception as documented #26534

deviantintegral commented Mar 14, 2018 •

edited

Loading

ogizanagi commented Mar 14, 2018 •

edited

Loading

dunglas commented Mar 15, 2018

ogizanagi commented Mar 15, 2018

dunglas commented Mar 15, 2018

ogizanagi commented Mar 15, 2018

deviantintegral commented Mar 16, 2018

nicolas-grekas commented Mar 19, 2018

deviantintegral commented Mar 22, 2018

ogizanagi Mar 23, 2018

deviantintegral Mar 23, 2018

ogizanagi Mar 23, 2018

ogizanagi Mar 23, 2018

deviantintegral Mar 23, 2018

ogizanagi Mar 23, 2018 •

edited

Loading

dunglas Mar 26, 2018

deviantintegral commented Mar 26, 2018

ogizanagi commented Mar 26, 2018

nicolas-grekas commented Apr 14, 2018

ogizanagi commented Apr 14, 2018

dunglas commented Apr 16, 2018

deviantintegral commented May 4, 2018

fabpot commented May 30, 2018

deviantintegral commented May 30, 2018

ogizanagi left a comment

ogizanagi May 30, 2018

deviantintegral Jun 21, 2018

ogizanagi Jun 21, 2018

deviantintegral Jun 21, 2018

ogizanagi Jun 21, 2018

nicolas-grekas commented Jun 21, 2018

deviantintegral commented Jun 21, 2018

ogizanagi left a comment

ogizanagi Jun 21, 2018

ogizanagi commented Jun 21, 2018

allow_extra_attributes does not throw an exception as documented #26534

allow_extra_attributes does not throw an exception as documented #26534

Conversation

deviantintegral commented Mar 14, 2018 • edited Loading

ogizanagi commented Mar 14, 2018 • edited Loading

dunglas commented Mar 15, 2018

ogizanagi commented Mar 15, 2018

dunglas commented Mar 15, 2018

ogizanagi commented Mar 15, 2018

deviantintegral commented Mar 16, 2018

nicolas-grekas commented Mar 19, 2018

deviantintegral commented Mar 22, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ogizanagi Mar 23, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deviantintegral commented Mar 26, 2018

ogizanagi commented Mar 26, 2018

nicolas-grekas commented Apr 14, 2018

ogizanagi commented Apr 14, 2018

dunglas commented Apr 16, 2018

deviantintegral commented May 4, 2018

fabpot commented May 30, 2018

deviantintegral commented May 30, 2018

ogizanagi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nicolas-grekas commented Jun 21, 2018

deviantintegral commented Jun 21, 2018

ogizanagi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ogizanagi commented Jun 21, 2018

deviantintegral commented Mar 14, 2018 •

edited

Loading

ogizanagi commented Mar 14, 2018 •

edited

Loading

ogizanagi Mar 23, 2018 •

edited

Loading