This repository has been archived on 2023-08-20. You can view files and clone it, but cannot push or open issues or pull requests.
Go to file
Nicolas Grekas 689056ef7f bug #40506 [Validator] Avoid triggering the autoloader for user-input values (Seldaek)
This PR was squashed before being merged into the 4.4 branch.

Discussion
----------

[Validator] Avoid triggering the autoloader for user-input values

| Q             | A
| ------------- | ---
| Branch?       | 4.4
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       |
| License       | MIT
| Doc PR        |

Following-up to https://twitter.com/seldaek/status/1372450636361502721 - mostly to see if the build passes or if this breaks some undocumented/unclear-to-me assumptions.

Essentially using the `Valid` constraint should only validate objects if they exist as objects. If a user sends a string and that gets assigned to a property, `Valid` should not attempt autoloading that user-given string.

As far as I can tell, this is used in two places:

- acb32dd396/src/Symfony/Component/Validator/Validator/RecursiveContextualValidator.php (L364-L365) where non-objects are anyway ignored, so this change is harmless there.
- acb32dd396/src/Symfony/Component/Validator/Validator/RecursiveContextualValidator.php (L652-L660) where it's explicitly passing anything in there to get the proper exception, so my change makes sure that exception is thrown *before* autoloading attempts. I am just not 100% sure if there are cases where validateGenericNode will receive a class name as a string to validate in $value. I can't imagine why it would but that doesn't mean it's true.

Commits
-------

e45eb23ba2 [Validator] Avoid triggering the autoloader for user-input values
2021-03-23 12:26:37 +01:00
.github Specify that we run CI on Ubuntu-20.04 2021-03-02 10:27:35 +01:00
src/Symfony bug #40506 [Validator] Avoid triggering the autoloader for user-input values (Seldaek) 2021-03-23 12:26:37 +01:00
.appveyor.yml Ignore indirect deprecation triggered by doctrine/orm 2021-02-16 10:34:45 +01:00
.editorconfig Update .editorconfig 2018-09-06 16:22:56 +02:00
.gitattributes "export-ignore" contracts and phpunit-bridge 2021-01-22 10:53:35 +01:00
.gitignore Run the phpunit-bridge from a PR 2019-08-02 17:46:19 +02:00
.php_cs.dist Update PHP CS Fixer config to v2.18 2021-01-18 03:36:26 +01:00
.travis.yml install compatible versions of mongodb/mongodb only 2021-02-17 15:20:29 +01:00
CHANGELOG-4.0.md Merge branch '3.4' into 4.1 2018-08-01 18:22:14 +02:00
CHANGELOG-4.1.md updated CHANGELOG for 4.1.10 2019-01-06 17:16:07 +01:00
CHANGELOG-4.2.md updated CHANGELOG for 4.2.10 2019-06-26 16:19:37 +02:00
CHANGELOG-4.3.md updated CHANGELOG for 4.3.10 2020-01-21 14:13:32 +01:00
CHANGELOG-4.4.md Update CHANGELOG for 4.4.20 2021-03-04 19:00:15 +01:00
CODE_OF_CONDUCT.md Added the Code of Conduct file 2018-10-10 03:13:30 -07:00
composer.json [TwigBridge] Allow version 3 of the Twig extra packages 2021-03-07 20:47:33 +01:00
CONTRIBUTING.md Mention the community review guide 2016-12-18 22:02:35 +01:00
CONTRIBUTORS.md Update CONTRIBUTORS for 4.4.20 2021-03-04 19:00:24 +01:00
LICENSE Bump license year 2021-01-01 10:24:35 +01:00
link Fix CS in link binary 2020-12-10 19:02:00 +01:00
phpunit Skip checking return types on PHP <= 7.2 2021-02-11 09:19:35 +01:00
phpunit.xml.dist Adds LDAP Adapter test in integration group 2020-11-16 15:17:13 +01:00
psalm.xml Adding a Github action to run Psalm 2021-02-25 17:18:18 +01:00
README.md Update README.md 2020-12-29 01:17:49 +01:00
UPGRADE-4.0.md Fix CS in changelogs 2020-12-10 17:34:26 +01:00
UPGRADE-4.1.md Merge branch '4.0' into 4.1 2018-05-31 12:17:53 +02:00
UPGRADE-4.2.md Merge branch '3.4' into 4.3 2020-01-08 18:19:22 +01:00
UPGRADE-4.3.md Merge branch '4.3' into 4.4 2019-11-19 13:20:06 +01:00
UPGRADE-4.4.md Fix CS in changelogs 2020-12-10 17:34:26 +01:00
UPGRADE-5.0.md Fix CS in changelogs 2020-12-10 17:34:26 +01:00

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony is used by thousands of web applications (including BlaBlaCar.com and Spotify.com) and most of the popular PHP projects (including Drupal and Magento).

Installation

Documentation

Community

Contributing

Symfony is an Open Source, community-driven project with thousands of contributors. Join them contributing code or contributing documentation.

Security Issues

If you discover a security vulnerability within Symfony, please follow our disclosure procedure.

About Us

Symfony development is sponsored by SensioLabs, led by the Symfony Core Team and supported by Symfony contributors.