[Security] make sure RoleVoter only vote for roles and don't produce fatal error on non-strings

Gladhon · Gladhon · commit 3b88cb764b12 · 2016-09-19T15:34:14.000+02:00
diff --git a/src/Symfony/Component/Security/Core/Authorization/Voter/RoleVoter.php b/src/Symfony/Component/Security/Core/Authorization/Voter/RoleVoter.php
@@ -12,6 +12,7 @@
 namespace Symfony\Component\Security\Core\Authorization\Voter;
 
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Role\RoleInterface;
 
 /**
  * RoleVoter votes if any attribute starts with a given prefix.
@@ -41,7 +42,9 @@ public function vote(TokenInterface $token, $subject, array $attributes)
         $roles = $this->extractRoles($token);
 
         foreach ($attributes as $attribute) {
-            if (0 !== strpos($attribute, $this->prefix)) {
+            if ($attribute instanceof RoleInterface) {
+                $attribute = $attribute->getRole();
+            } elseif (!is_string($attribute) || 0 !== strpos($attribute, $this->prefix)) {
                 continue;
             }
 
diff --git a/src/Symfony/Component/Security/Core/Tests/Authorization/Voter/RoleVoterTest.php b/src/Symfony/Component/Security/Core/Tests/Authorization/Voter/RoleVoterTest.php
@@ -36,6 +36,12 @@ public function getVoteTests()
             array(array('ROLE_FOO'), array('ROLE_FOO'), VoterInterface::ACCESS_GRANTED),
             array(array('ROLE_FOO'), array('FOO', 'ROLE_FOO'), VoterInterface::ACCESS_GRANTED),
             array(array('ROLE_BAR', 'ROLE_FOO'), array('ROLE_FOO'), VoterInterface::ACCESS_GRANTED),
+
+            array(array('ROLE_FOO'), array('some'), VoterInterface::ACCESS_ABSTAIN),
+            array(array('ROLE_FOO'), array( new Role('ROLE_FOO')), VoterInterface::ACCESS_GRANTED),
+            array(array('ROLE_FOO'), array( new \StdClass() ), VoterInterface::ACCESS_ABSTAIN),
+            array(array('ROLE_FOO'), array( new \StdClass(),'some', 'ROLE_FOO' ), VoterInterface::ACCESS_GRANTED),
+            array(array('ROLE_FOO'), array( new \StdClass(),'some', 'ROLE_NON_FOO' ), VoterInterface::ACCESS_DENIED),
         );
     }
 
