Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 41000f1

Browse filesBrowse files
nicolas-grekasnicolas-grekas
committed
[Security] dont do nested calls to serialize()
1 parent afb7bb5 commit 41000f1
Copy full SHA for 41000f1

File tree

Expand file treeCollapse file tree

10 files changed

+38
-19
lines changed
Filter options
Expand file treeCollapse file tree

10 files changed

+38
-19
lines changed

‎src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php
+21-9Lines changed: 21 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -134,25 +134,24 @@ public function eraseCredentials()
134134

135135
/**
136136
* {@inheritdoc}
137+
*
138+
* @param bool $isCalledFromOverridingMethod Must be set to true when called from an overriding method
139+
*
140+
* @return string|array Returns an array when $isCalledFromOverridingMethod is set to true
137141
*/
138142
public function serialize()
139143
{
140-
return serialize(
141-
[
142-
\is_object($this->user) ? clone $this->user : $this->user,
143-
$this->authenticated,
144-
array_map(function ($role) { return clone $role; }, $this->roles),
145-
$this->attributes,
146-
]
147-
);
144+
$serialized = [$this->user, $this->authenticated, $this->roles, $this->attributes];
145+
146+
return $this->doSerialize($serialized, \func_num_args() ? \func_get_arg(0) : null);
148147
}
149148

150149
/**
151150
* {@inheritdoc}
152151
*/
153152
public function unserialize($serialized)
154153
{
155-
list($this->user, $this->authenticated, $this->roles, $this->attributes) = unserialize($serialized);
154+
list($this->user, $this->authenticated, $this->roles, $this->attributes) = \is_array($serialized) ? $serialized : unserialize($serialized);
156155
}
157156

158157
/**
@@ -232,6 +231,19 @@ public function __toString()
232231
return sprintf('%s(user="%s", authenticated=%s, roles="%s")', $class, $this->getUsername(), json_encode($this->authenticated), implode(', ', $roles));
233232
}
234233

234+
/**
235+
* @internal
236+
*/
237+
protected function doSerialize($serialized, $isCalledFromOverridingMethod)
238+
{
239+
if (null === $isCalledFromOverridingMethod) {
240+
$trace = debug_backtrace(DEBUG_BACKTRACE_PROVIDE_OBJECT, 3);
241+
$isCalledFromOverridingMethod = isset($trace[2]['function'], $trace[2]['object']) && 'serialize' === $trace[2]['function'] && $this === $trace[2]['object'];
242+
}
243+
244+
return $isCalledFromOverridingMethod ? $serialized : serialize($serialized);
245+
}
246+
235247
private function hasUserChanged(UserInterface $user)
236248
{
237249
if (!($this->user instanceof UserInterface)) {

‎src/Symfony/Component/Security/Core/Authentication/Token/AnonymousToken.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Core/Authentication/Token/AnonymousToken.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ public function serialize()
6767
*/
6868
public function unserialize($serialized)
6969
{
70-
list($this->secret, $parentStr) = unserialize($serialized);
70+
list($this->secret, $parentStr) = \is_array($serialized) ? $serialized : unserialize($serialized);
7171
parent::unserialize($parentStr);
7272
}
7373
}

‎src/Symfony/Component/Security/Core/Authentication/Token/PreAuthenticatedToken.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Core/Authentication/Token/PreAuthenticatedToken.php
+6-2Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,18 +76,22 @@ public function eraseCredentials()
7676

7777
/**
7878
* {@inheritdoc}
79+
*
80+
* @param bool $isCalledFromOverridingMethod Must be set to true when called from an overriding method
7981
*/
8082
public function serialize()
8183
{
82-
return serialize([$this->credentials, $this->providerKey, parent::serialize()]);
84+
$serialized = [$this->credentials, $this->providerKey, parent::serialize(true)];
85+
86+
return $this->doSerialize($serialized, \func_num_args() ? \func_get_arg(0) : null);
8387
}
8488

8589
/**
8690
* {@inheritdoc}
8791
*/
8892
public function unserialize($str)
8993
{
90-
list($this->credentials, $this->providerKey, $parentStr) = unserialize($str);
94+
list($this->credentials, $this->providerKey, $parentStr) = \is_array($str) ? $str : unserialize($str);
9195
parent::unserialize($parentStr);
9296
}
9397
}

‎src/Symfony/Component/Security/Core/Authentication/Token/RememberMeToken.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Core/Authentication/Token/RememberMeToken.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ public function serialize()
106106
*/
107107
public function unserialize($serialized)
108108
{
109-
list($this->secret, $this->providerKey, $parentStr) = unserialize($serialized);
109+
list($this->secret, $this->providerKey, $parentStr) = \is_array($serialized) ? $serialized : unserialize($serialized);
110110
parent::unserialize($parentStr);
111111
}
112112
}

‎src/Symfony/Component/Security/Core/Authentication/Token/UsernamePasswordToken.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Core/Authentication/Token/UsernamePasswordToken.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ public function serialize()
9999
*/
100100
public function unserialize($serialized)
101101
{
102-
list($this->credentials, $this->providerKey, $parentStr) = unserialize($serialized);
102+
list($this->credentials, $this->providerKey, $parentStr) = \is_array($serialized) ? $serialized : unserialize($serialized);
103103
parent::unserialize($parentStr);
104104
}
105105
}

‎src/Symfony/Component/Security/Core/Exception/AccountStatusException.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Core/Exception/AccountStatusException.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ public function serialize()
5555
*/
5656
public function unserialize($str)
5757
{
58-
list($this->user, $parentData) = unserialize($str);
58+
list($this->user, $parentData) = \is_array($str) ? $str : unserialize($str);
5959

6060
parent::unserialize($parentData);
6161
}

‎src/Symfony/Component/Security/Core/Exception/CustomUserMessageAuthenticationException.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Core/Exception/CustomUserMessageAuthenticationException.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ public function serialize()
7272
*/
7373
public function unserialize($str)
7474
{
75-
list($parentData, $this->messageKey, $this->messageData) = unserialize($str);
75+
list($parentData, $this->messageKey, $this->messageData) = \is_array($str) ? $str : unserialize($str);
7676

7777
parent::unserialize($parentData);
7878
}

‎src/Symfony/Component/Security/Core/Exception/UsernameNotFoundException.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Core/Exception/UsernameNotFoundException.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ public function serialize()
6565
*/
6666
public function unserialize($str)
6767
{
68-
list($this->username, $parentData) = unserialize($str);
68+
list($this->username, $parentData) = \is_array($str) ? $str : unserialize($str);
6969

7070
parent::unserialize($parentData);
7171
}

‎src/Symfony/Component/Security/Core/Tests/Authentication/Token/AbstractTokenTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Core/Tests/Authentication/Token/AbstractTokenTest.php
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,9 @@ public function __construct($user, array $roles = [])
4343
$this->setUser($user);
4444
}
4545

46+
/**
47+
* @param bool $isCalledFromOverridingMethod Must be set to true when called from an overriding method
48+
*/
4649
public function serialize()
4750
{
4851
return serialize([$this->credentials, parent::serialize()]);

‎src/Symfony/Component/Security/Guard/Token/PostAuthenticationGuardToken.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Guard/Token/PostAuthenticationGuardToken.php
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,15 +76,15 @@ public function getProviderKey()
7676
*/
7777
public function serialize()
7878
{
79-
return serialize([$this->providerKey, parent::serialize()]);
79+
return serialize([$this->providerKey, parent::serialize(true)]);
8080
}
8181

8282
/**
8383
* {@inheritdoc}
8484
*/
8585
public function unserialize($serialized)
8686
{
87-
list($this->providerKey, $parentStr) = unserialize($serialized);
87+
list($this->providerKey, $parentStr) = \is_array($serialized) ? $serialized : unserialize($serialized);
8888
parent::unserialize($parentStr);
8989
}
9090
}

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.