[Security] Throw LogicException instead of Error when trying to generate logout-… #47932
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
…URL without request
Currently the LogoutUrlGenerator will raise an Error if called without a current request present because it does not check if there is a request present before using it.
The error that is raised is:
Call to a member function getBaseUrl() on null
on line 110 (line 114 with this patch applied)In my use-case, this get's called by
Symfony\Bundle\SecurityBundle\DataCollector\SecurityDataCollector::collect()
using the following code:The above code inside the
SecurityDataCollector
tries to "fail silently" if no logout-URL cannot be generated. But this silent-fail fails itself because the thrown "exception" is not an\Exception
, but an\Error
instead (\Error
is not an descendant of\Exception
, so it does not get catched here).In order to resolve this situation, the proposed patch makes the LogoutUrlGenerator explicitly test if a request is actually present and then throw a
\LogicException
instead of an\Error
if that check fails.