diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Hardening Security - Unserialize DumpDataCollector

Browse Source
This commit is contained in:
Jérémy Derussé 2021-03-22 20:15:23 +01:00
parent 602b52041a
commit 214dbfec51
No known key found for this signature in database
GPG Key ID: 2083FA5758C473D2
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/Symfony/Component/HttpKernel/DataCollector/DumpDataCollector.php
View File

@ -183,6 +183,11 @@ class DumpDataCollector extends DataCollector implements DataDumperInterface
$charset = array_pop($this->data);
$fileLinkFormat = array_pop($this->data);
$this->dataCount = \count($this->data);
foreach ($this->data as $dump) {
if (!\is_string($dump['name']) || !\is_string($dump['file']) || !\is_int($dump['line'])) {
throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
}
}
self::__construct($this->stopwatch, \is_string($fileLinkFormat) || $fileLinkFormat instanceof FileLinkFormatter ? $fileLinkFormat : null, \is_string($charset) ? $charset : null);
}
@ -257,7 +262,7 @@ class DumpDataCollector extends DataCollector implements DataDumperInterface
}
}
private function doDump(DataDumperInterface $dumper, $data, string $name, string $file, int $line)
private function doDump(DataDumperInterface $dumper, Data $data, string $name, string $file, int $line)
{
if ($dumper instanceof CliDumper) {
$contextDumper = function ($name, $file, $line, $fmt) {