symfony · fabpot · Apr 6, 2019 · Apr 6, 2019
diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php
@@ -834,6 +834,10 @@ private function addValidationSection(ArrayNodeDefinition $rootNode)
                                ->end()
                            ->end()
                        ->end()
+                        ->booleanNode('disable_not_compromised_password')
+                            ->defaultFalse()
+                            ->info('Disable NotCompromisedPassword Validator: the value will always be valid.')
+                        ->end()
                        ->arrayNode('auto_mapping')
                            ->useAttributeAsKey('namespace')
                            ->normalizeKeys(false)

diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php
@@ -1229,6 +1229,11 @@ private function registerValidationConfiguration(array $config, ContainerBuilder
        if (!$propertyInfoEnabled || !$config['auto_mapping'] || !class_exists(PropertyInfoLoader::class)) {
            $container->removeDefinition('validator.property_info_loader');
        }
+
+        $container
+            ->getDefinition('validator.not_compromised_password')
+            ->setArgument(2, $config['disable_not_compromised_password'])
+        ;
    }

    private function registerValidatorMapping(ContainerBuilder $container, array $config, array &$files)

diff --git a/src/Symfony/Bundle/FrameworkBundle/Resources/config/validator.xml b/src/Symfony/Bundle/FrameworkBundle/Resources/config/validator.xml
@@ -64,6 +64,7 @@
        <service id="validator.not_compromised_password" class="Symfony\Component\Validator\Constraints\NotCompromisedPasswordValidator">
            <argument type="service" id="http_client" on-invalid="null" />
            <argument>%kernel.charset%</argument>
+            <argument type="constant">false</argument>
            <tag name="validator.constraint_validator" alias="Symfony\Component\Validator\Constraints\NotCompromisedPasswordValidator" />
        </service>


diff --git a/src/Symfony/Component/Validator/Constraints/NotCompromisedPasswordValidator.php b/src/Symfony/Component/Validator/Constraints/NotCompromisedPasswordValidator.php
@@ -32,15 +32,17 @@ class NotCompromisedPasswordValidator extends ConstraintValidator

    private $httpClient;
    private $charset;
+    private $disabled;

-    public function __construct(HttpClientInterface $httpClient = null, string $charset = 'UTF-8')
+    public function __construct(HttpClientInterface $httpClient = null, string $charset = 'UTF-8', bool $disabled = false)
    {
        if (null === $httpClient && !class_exists(HttpClient::class)) {
            throw new \LogicException(sprintf('The "%s" class requires the "HttpClient" component. Try running "composer require symfony/http-client".', self::class));
        }

        $this->httpClient = $httpClient ?? HttpClient::create();
        $this->charset = $charset;
+        $this->disabled = $disabled;
    }

    /**
@@ -54,6 +56,10 @@ public function validate($value, Constraint $constraint)
            throw new UnexpectedTypeException($constraint, NotCompromisedPassword::class);
        }

+        if ($this->disabled) {
+            return;
+        }
+
        if (null !== $value && !is_scalar($value) && !(\is_object($value) && method_exists($value, '__toString'))) {
            throw new UnexpectedTypeException($value, 'string');
        }

diff --git a/src/Symfony/Component/Validator/Tests/Constraints/NotCompromisedPasswordValidatorTest.php b/src/Symfony/Component/Validator/Tests/Constraints/NotCompromisedPasswordValidatorTest.php
@@ -60,6 +60,17 @@ public function testEmptyStringIsValid()
        $this->assertNoViolation();
    }

+    public function testInvalidPasswordButDisabled()
+    {
+        $r = new \ReflectionProperty($this->validator, 'disabled');
+        $r->setAccessible(true);
+        $r->setValue($this->validator, true);
+
+        $this->validator->validate(self::PASSWORD_LEAKED, new NotCompromisedPassword());
+
+        $this->assertNoViolation();
+    }
+
    public function testInvalidPassword()
    {
        $constraint = new NotCompromisedPassword();