diogo
/
symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[Security] AbstractVoter method supportsAttribute gives false positive if attribute is zero (0)

This commit is contained in:
Martynas Narbutas 2016-12-03 11:01:12 +01:00
parent e0bd2a2b08
commit 8306530e60
2 changed files with 72 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Symfony/Component/Security/Core/Authorization/Voter/AbstractVoter.php
View File

@ -26,7 +26,7 @@ abstract class AbstractVoter implements VoterInterface
*/
public function supportsAttribute($attribute)
{
return in_array($attribute, $this->getSupportedAttributes());
return in_array($attribute, $this->getSupportedAttributes(), true);
}
/**

71
src/Symfony/Component/Security/Core/Tests/Authorization/Voter/AbstractVoterTest.php
View File

@ -16,6 +16,9 @@ use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
class AbstractVoterTest extends \PHPUnit_Framework_TestCase
{
/**
* @var TokenInterface
*/
protected $token;
protected function setUp()
@ -23,6 +26,9 @@ class AbstractVoterTest extends \PHPUnit_Framework_TestCase
$this->token = $this->getMock('Symfony\Component\Security\Core\Authentication\Token\TokenInterface');
}
/**
* @return array
*/
public function getTests()
{
return array(
@ -53,6 +59,71 @@ class AbstractVoterTest extends \PHPUnit_Framework_TestCase
$this->assertEquals($expectedVote, $voter->vote($this->token, $object, $attributes), $message);
}
/**
* @return array
*/
public function getSupportsAttributeData()
{
return array(
'positive_string_edit' => array(
'expected' => true,
'attribute' => 'EDIT',
'message' => 'expected TRUE given as attribute EDIT is supported',
),
'positive_string_create' => array(
'expected' => true,
'attribute' => 'CREATE',
'message' => 'expected TRUE as given attribute CREATE is supported',
),
'negative_string_read' => array(
'expected' => false,
'attribute' => 'READ',
'message' => 'expected FALSE as given attribute READ is not supported',
),
'negative_string_random' => array(
'expected' => false,
'attribute' => 'random',
'message' => 'expected FALSE as given attribute "random" is not supported',
),
'negative_string_0' => array(
'expected' => false,
'attribute' => '0',
'message' => 'expected FALSE as given attribute "0" is not supported',
),
// this set of data gives false positive if in_array is not used with strict flag set to 'true'
'negative_int_0' => array(
'expected' => false,
'attribute' => 0,
'message' => 'expected FALSE as given attribute 0 is not string',
),
'negative_int_1' => array(
'expected' => false,
'attribute' => 1,
'message' => 'expected FALSE as given attribute 1 is not string',
),
'negative_int_7' => array(
'expected' => false,
'attribute' => 7,
'message' => 'expected FALSE as attribute 7 is not string',
),
);
}
/**
* @dataProvider getSupportsAttributeData
*
* @param bool $expected
* @param string $attribute
* @param string $message
*/
public function testSupportsAttribute($expected, $attribute, $message)
{
$voter = new AbstractVoterTest_Voter();
$this->assertEquals($expected, $voter->supportsAttribute($attribute), $message);
}
}
class AbstractVoterTest_Voter extends AbstractVoter