diogo
/
symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bug #40286 [Security] #[CurrentUser] arguments should resolve to null for "anon." (chalasr) 

This PR was merged into the 5.2 branch.

Discussion
----------

[Security] #[CurrentUser] arguments should resolve to null for "anon."

| Q             | A
| ------------- | ---
| Branch?       | 5.2
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | -

The UserValueResolver should only resolve `UserInterface` (or subtype) typed arguments:
bc9e946a56/src/Symfony/Component/Security/Http/Controller/UserValueResolver.php (L54-L55)
When using the `#CurrentUser` attribute with an AnonymousToken in the storage, the resolved argument value is `anon.`. This PR fixes it.

/cc @jvasseur

Commits
-------

8d3078dd35 [Security] #[CurrentUser] argument should resolve to null when it is anonymous
This commit is contained in:
Robin Chalas 2021-02-24 15:02:23 +01:00
parent 3a2906cce9 8d3078dd35
commit b03731981a
2 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/Symfony/Component/Security/Http/Controller/UserValueResolver.php
View File

@ -35,12 +35,9 @@ final class UserValueResolver implements ArgumentValueResolverInterface
public function supports(Request $request, ArgumentMetadata $argument): bool
{
if ($argument->getAttribute() instanceof CurrentUser) {
return true;
}
// only security user implementations are supported
if (UserInterface::class !== $argument->getType()) {
// with the attribute, the type can be any UserInterface implementation
// otherwise, the type must be UserInterface
if (UserInterface::class !== $argument->getType() && !$argument->getAttribute() instanceof CurrentUser) {
return false;
}

11
src/Symfony/Component/Security/Http/Tests/Controller/UserValueResolverTest.php
View File

@ -83,6 +83,17 @@ class UserValueResolverTest extends TestCase
$this->assertSame([$user], iterator_to_array($resolver->resolve(Request::create('/'), $metadata)));
}
public function testResolveWithAttributeAndNoUser()
{
$tokenStorage = new TokenStorage();
$tokenStorage->setToken(new UsernamePasswordToken('username', 'password', 'provider'));
$resolver = new UserValueResolver($tokenStorage);
$metadata = new ArgumentMetadata('foo', null, false, false, null, false, new CurrentUser());
$this->assertFalse($resolver->supports(Request::create('/'), $metadata));
}
public function testIntegration()
{
$user = $this->createMock(UserInterface::class);