Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

[Security] Fix for "Call to a member function getBaseUrl() on null" when generating a logout URL and there is no current request #27175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

[Security] Fix for "Call to a member function getBaseUrl() on null" when generating a logout URL and there is no current request #27175

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions 4 src/Symfony/Component/Security/Http/Logout/LogoutUrlGenerator.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,10 @@ private function generateLogoutUrl($key, $referenceType)

$request = $this->requestStack->getCurrentRequest();

if (!$request) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How can there be no request at this stage? Could you create a small example application that allows to reproduce?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After $response = $kernel->handle($request); in the front-controller Symfony\Component\HttpKernel\HttpKernel::finishRequest is executed and pops the request from the requestStack. The requestStack is now empty.
Events and other code that is executed after $kernel->handle (like terminate events) will find the empty requestStack, which is correct, there is no request anymore (response is already send).

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's right, but why is the data collector triggered at this stage at all? Collection data should happen earlier during the kernel.response event.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Finally, I found the problem why the data collection is triggered.
During the kernel.terminate the thrown exception is caught and forwarded to Symfony\Component\HttpKernel\HttpKernel::handleException, just like other exceptions in other phases of the request lifecycle.
The Symfony\Component\HttpKernel\EventListener\ExceptionListener dispatches a kernel.exception event, this event is listened by Symfony\Component\HttpKernel\EventListener\ExceptionListener.
Symfony\Component\HttpKernel\EventListener\ExceptionListener will start a new sub-request, all the normal kernel events are dispatched including kernel.response.
At this moment the data collection is triggered, Symfony\Component\HttpKernel\EventListener\ProfilerListener listens to the kernel.response event and starts the collection.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When the subrequest is handled, it will be pushed onto the stack which therefore shouldn't be empty. So I still think we should first look into an example application that allows to reproduce the issue and see if there isn't another root cause.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@maartendekeizer would you be able to provide a reproducer we could play with to see how this can arise?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can only reproduce it on IIS 10, used PHP 7.1.5 and PHP 7.1.18. Theire is no issue when I use Apache2 with PHP 7.1.18 or Nginx with PHP 7.1.18.
https://github.com/maartendekeizer/symfony-demo-for-27175
After checkout and run composer install, visit the page /secure, login with the button. Change src/EventListener/TestWithFailureSubscriber.php

-        //$a->doSomeThing(); // uncomment this line to create an error
+        $a->doSomeThing(); // uncomment this line to create an error

Refresh the /secure page

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cannot reproduce this behaviour with the built-in web server neither. Can you try to debug where the actual difference is when using IIS?

throw new \LogicException('Unable to generate the logout URL without a request.');
}

$url = UrlGeneratorInterface::ABSOLUTE_URL === $referenceType ? $request->getUriForPath($logoutPath) : $request->getBaseUrl().$logoutPath;

if (!empty($parameters)) {
Expand Down
18 changes: 18 additions & 0 deletions 18 src/Symfony/Component/Security/Http/Tests/Logout/LogoutUrlGeneratorTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,4 +112,22 @@ public function testUnableToGuessThrowsException()

$this->generator->getLogoutPath();
}

/**
* @expectedException \LogicException
* @expectedExceptionMessage Unable to generate the logout URL without a request.
*/
public function testWithoutCurrentRequest()
{
// build a requestStack without a current request
$requestStack = $this->getMockBuilder(RequestStack::class)->getMock();
$request = $this->getMockBuilder(Request::class)->getMock();
$requestStack->method('getCurrentRequest')->willReturn(null);

$generator = new LogoutUrlGenerator($requestStack, null, $this->tokenStorage);

$generator->registerListener('secured_area', '/logout', null, null);
$generator->setCurrentFirewall('secured_area');
$generator->getLogoutPath();
}
}
Morty Proxy This is a proxified and sanitized view of the page, visit original site.