[Security] fix unserializing session payloads from v4 #44805
Conversation
|
IMO these classes should exist only to allow unserialization, so in my package, every method throws a |
|
I think there is no need for such detailed care. I made the constructor private and the class |
Ok, I see, then I would remove any public method. These classes only exist for BC and IMO should not have any behavior. |
|
We should add a test that deserializes a token serialized with 4.4 and checks if that token is usable. For instance, I would expect to run into new problems if the tokens returned arrays of |
b506b53 to
642a4c4
Compare
|
I removed all methods but |
There was a problem hiding this comment.
Thanks, this looks OK to me.
I agree with @derrabus. We should at least add a test with a payload like:
// serialized string created on Symfony 4.4 using the following command:
// php -r 'require_once __DIR__."/vendor/autoload.php"; echo serialize(new \\Symfony\\Component\\Security\\Core\\Authentication\\Token\\UsernamePasswordToken("sf", null, "main", [new Symfony\\Component\\Security\\Core\\Role\\Role("ROLE_USER")]));'
$serialized = 'O:74:"Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken":3:{i:0;N;i:1;s:4:"main";i:2;a:5:{i:0;s:2:"sf";i:1;b:1;i:2;a:1:{i:0;O:41:"Symfony\Component\Security\Core\Role\Role":1:{s:47:"Symfony\Component\Security\Core\Role\Rolerole";s:9:"ROLE_USER";}}i:3;a:0:{}i:4;a:1:{i:0;s:9:"ROLE_USER";}}}';|
Thanks for the hint, test added. |
113e4d0 to
b73ac9a
Compare
b73ac9a to
d9e1e82
Compare
Replaces #44801
I propose to reintroduce these classes to ease transitioning to v5,
then removing them in v6.