Symfony version(s) affected

6.4.x, 7.x

Description

SecurityDataCollector::getVoters() currently has the return type array|Data. However, the following type error can occur:

Twig\Error\RuntimeError:
An exception has been thrown during the rendering of a template ("Symfony\Bundle\SecurityBundle\DataCollector\SecurityDataCollector::getVoters(): Return value must be of type Symfony\Component\VarDumper\Cloner\Data|array, null returned").

  at vendor\symfony\security-bundle\Resources\views\Collector\security.html.twig:394

TypeError:
Symfony\Bundle\SecurityBundle\DataCollector\SecurityDataCollector::getVoters(): Return value must be of type Symfony\Component\VarDumper\Cloner\Data|array, null returned

  at vendor\symfony\security-bundle\DataCollector\SecurityDataCollector.php:310
  at Symfony\Bundle\SecurityBundle\DataCollector\SecurityDataCollector->getVoters()
     (vendor\twig\twig\src\Extension\CoreExtension.php:1635)

This is because the given AccessDecisionManager instance might be of type TraceableAccessDecisionManager - but not return any voters. In such a case $this->data['voters'] will not be initialized at all and thus SecurityDataCollector::getVoters() would return null, which is not allowed by the return type. The Twig template for the Profiler also seems to assume the getVoters() can return null - which was actually the case in previous Symfony versions, as there was only a return type annotation.

That being said - the core reason why there are not voters collected in the first place is something else entirely. The TraceableAccessDecisionManager does not / cannot take a decorated AccessDecisionManager into account, as the getVoters() method is not part of an interface. Thus, when you decorate Symfony's default AccessDecisionManager, no voters will be retrieved from the new service - unless you happen to implement a getVoters() method as well (see reproduction below).

How to reproduce

A simple reproduction is to decorate the default security.access.decision_manager like so:

# config/services.yaml
services:
    App\Security\DecoratedAccessDecisionManager:
        decorates: security.access.decision_manager

// src/Security/DecoratedAccessDecisionManager.php
namespace App\Security;

use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;

class DecoratedAccessDecisionManager implements AccessDecisionManagerInterface
{
    public function __construct(public readonly AccessDecisionManagerInterface $inner)
    {
    }

    public function decide(TokenInterface $token, array $attributes, mixed $object = null): bool
    {
        return $this->inner->decide($token, $attributes, $object);
    }
}

If you then open the profiler and go to the Security tab, the aforementioned error will occur.

Possible Solution

Either null needs to be added as an allowed return type for SecurityDataCollector::getVoters() - or $this->data['voters'] always needs to be initialized with data.

Additional Context

No response