NotificationsYou must be signed in to change notification settings
Fork9.7k
Star30.8k

Commitd7cb006

committed

bug#25340 [Serializer] Unset attributes when creating child context (dunglas)

This PR was merged into the 3.3 branch.Discussion----------[Serializer] Unset attributes when creating child context | Q | A | ------------- | --- | Branch? | 3.3 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | n/a | License | MIT | Doc PR | n/aIn some cases, the `attributes` key isn't overrode when creating the context passed to nested normalizers. It's definitely a bug, but an attacker cannot access to non public data (ignored attributes are checked before the `attributes` key). However some data that must be public may be missing as highlighted by the test.I've introduced the initial bug here:#18834Commits-------4ff9d99 [Serializer] Unset attributes when creating child context

2 parents6e7e684 +4ff9d99 commitd7cb006Copy full SHA for d7cb006

File tree

2 files changed

+12

-0

lines changed

src/Symfony/Component/Serializer
- Normalizer
  - AbstractNormalizer.php
- Tests/Normalizer
  - ObjectNormalizerTest.php

2 files changed

+12

-0

lines changed

`‎src/Symfony/Component/Serializer/Normalizer/AbstractNormalizer.php‎`

Lines changed: 2 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -402,6 +402,8 @@ protected function createChildContext(array $parentContext, $attribute)`
`402`	`402`	`{`
`403`	`403`	`if (isset($parentContext[self::ATTRIBUTES][$attribute])) {`
`404`	`404`	`$parentContext[self::ATTRIBUTES] =$parentContext[self::ATTRIBUTES][$attribute];`
	`405`	`+ }else {`
	`406`	`+ unset($parentContext[self::ATTRIBUTES]);`
`405`	`407`	`}`
`406`	`408`
`407`	`409`	`return$parentContext;`

`‎src/Symfony/Component/Serializer/Tests/Normalizer/ObjectNormalizerTest.php‎`

Lines changed: 10 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -673,6 +673,16 @@ public function testAttributesContextNormalize()`
`673`	`673`	`),`
`674`	`674`	`$serializer->normalize($objectDummy,null,$context)`
`675`	`675`	`);`
	`676`	`+`
	`677`	`+$context =array('attributes' =>array('foo','baz','object'));`
	`678`	`+$this->assertEquals(`
	`679`	`+array(`
	`680`	`+'foo' =>'foo',`
	`681`	`+'baz' =>true,`
	`682`	`+'object' =>array('foo' =>'innerFoo','bar' =>'innerBar'),`
	`683`	`+ ),`
	`684`	`+$serializer->normalize($objectDummy,null,$context)`
	`685`	`+ );`
`676`	`686`	`}`
`677`	`687`
`678`	`688`	`publicfunctiontestAttributesContextDenormalize()`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Commitd7cb006

File tree

2 files changed

2 files changed

`‎src/Symfony/Component/Serializer/Normalizer/AbstractNormalizer.php‎`

`‎src/Symfony/Component/Serializer/Tests/Normalizer/ObjectNormalizerTest.php‎`

0 commit comments