Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[Security] AccountStatusException::$user should be nullable #44259

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 13, 2022
Merged

[Security] AccountStatusException::$user should be nullable #44259

merged 1 commit into from
Feb 13, 2022

Conversation

acantepie
Copy link

@acantepie acantepie commented Nov 24, 2021

Q A
Branch? 4.4
Bug fix? yes
New feature? no
Deprecations? no
Tickets
License MIT
Doc PR

This PR fix error when throw an excepion extending AccountStatusException (CustomUserMessageAccountStatusException for example)

Error: Typed property Symfony\Component\Security\Core\Exception\AccountStatusException::$user must not be accessed before initialization

@carsonbot carsonbot added this to the 6.0 milestone Nov 24, 2021
@carsonbot
Copy link

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has a contribution guide which I suggest you to read.

In short:

  • Always add tests
  • Keep backward compatibility (see https://symfony.com/bc).
  • Bug fixes must be submitted against the lowest maintained branch where they apply (see https://symfony.com/releases)
  • Features and deprecations must be submitted against the 5.4 branch.

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

@acantepie acantepie changed the title Initialize AccountStatusException $user property [Security] Initialize AccountStatusException $user property Nov 24, 2021
@carsonbot
Copy link

Hey!

I think @rfaivre has recently worked with this code. Maybe they can help review this?

Cheers!

Carsonbot

@nicolas-grekas
Copy link
Member

Changing the public API looks wrong to me. Your child class should call setUser() instead.

@carsonbot carsonbot changed the title [Security] Initialize AccountStatusException $user property Initialize AccountStatusException $user property Dec 15, 2021
@derrabus
Copy link
Member

The type declaration has been removed from the 6.0 branch already which also explains the merge conflict, GitHub reports.

@nicolas-grekas I think, this error is raised if we attempt to serialize an instance of this class without setting a user. The instance would kind-of be in an invalid state without the user, but the error message that is triggered is probably not helpful.

@stof
Copy link
Member

stof commented Dec 15, 2021

the error also happens if someone calls the getter on an exception on which the setter has not been called.

@derrabus
Copy link
Member

the error also happens if someone calls the getter on an exception on which the setter has not been called.

Yes. And this basically tells us that the @return on 5.4 was lying: That method could return null previously.

I think, we have two options here:

  • Raise a LogicException if the getter is called without a prior setter call because it's clearly a mistake that the exceotion is raised without a user being set.
  • Make the return type nullable. Even if there is already code out there that provides a custom child class, PHP would allow us to do that because a child class may narrow down a nullable return type to non-nullable.

Either way, on 6.1 we would need to fix the serialization. I don't think that we should rais an exception when serializing/deserializing this class, even if it's in an invalid state.

@carsonbot carsonbot changed the title Initialize AccountStatusException $user property [Security] Initialize AccountStatusException $user property Feb 9, 2022
@nicolas-grekas nicolas-grekas changed the title [Security] Initialize AccountStatusException $user property [Security] AccountStatusException::$user should be nullable Feb 13, 2022
@nicolas-grekas nicolas-grekas modified the milestones: 6.0, 4.4 Feb 13, 2022
@nicolas-grekas
Copy link
Member

Thank you @acantepie.

@nicolas-grekas nicolas-grekas merged commit 4145222 into symfony:4.4 Feb 13, 2022
@fabpot fabpot mentioned this pull request Feb 28, 2022
This was referenced Feb 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants