8000 security #cve-2021-41268 [SecurityBundle] Default signature_propertie… · symfony/symfony@4a1877e · GitHub
[go: up one dir, main page]
Skip to content

Commit 4a1877e

Browse files
nicolas-grekasnicolas-grekas
committed
security #cve-2021-41268 [SecurityBundle] Default signature_properties to the previous behavior (wouterj)
This PR was merged into the 5.3 branch.
2 parents dcdd62c + 36a808b commit 4a1877e

File tree

3 files changed

+41
-10
lines changed

3 files changed

+41
-10
lines changed

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/RememberMeFactory.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -208,6 +208,7 @@ public function addConfiguration(NodeDefinition $node)
208208
->requiresAtLeastOneElement()
209209
->info('An array of properties on your User that are used to sign the remember-me cookie. If any of these change, all existing cookies will become invalid.')
210210
->example(['email', 'password'])
211+
->defaultValue(['password'])
211212
->end()
212213
->arrayNode('token_provider')
213214
->beforeNormalization()

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/Bundle/RememberMeBundle/Security/UserChangingUserProvider.php

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -21,33 +21,40 @@ class UserChangingUserProvider implements UserProviderInterface
2121
{
2222
private $inner;
2323

24+
public static $changePassword = false;
25+
2426
public function __construct(InMemoryUserProvider $inner)
2527
{
2628
$this->inner = $inner;
2729
}
2830

2931
public function loadUserByUsername($username)
3032
{
31-
return $this->inner->loadUserByUsername($username);
33+
return $this->changeUser($this->inner->loadUserByUsername($username));
3234
}
3335

3436
public function loadUserByIdentifier(string $userIdentifier): UserInterface
3537
{
36-
return $this->inner->loadUserByIdentifier($userIdentifier);
38+
return $this->changeUser($this->inner->loadUserByIdentifier($userIdentifier));
3739
}
3840

3941
public function refreshUser(UserInterface $user)
4042
{
41-
$user = $this->inner->refreshUser($user);
42-
43-
$alterUser = \Closure::bind(function (InMemoryUser $user) { $user->password = 'foo'; }, null, class_exists(User::class) ? User::class : InMemoryUser::class);
44-
$alterUser($user);
45-
46-
return $user;
43+
return $this->changeUser($this->inner->refreshUser($user));
4744
}
4845

4946
public function supportsClass($class)
5047
{
5148
return $this->inner->supportsClass($class);
5249
}
50+
51+
private function changeUser(UserInterface $user): UserInterface
52+
{
53+
if (self::$changePassword) {
54+
$alterUser = \Closure::bind(function (InMemoryUser $user) { $user->password = 'changed!'; }, null, class_exists(User::class) ? User::class : InMemoryUser::class);
55+
$alterUser($user);
56+
}
57+
58+
return $user;
59+
}
5360
}

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/RememberMeTest.php

Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,15 @@
1111

1212
namespace Symfony\Bundle\SecurityBundle\Tests\Functional;
1313

14+
use Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\RememberMeBundle\Security\UserChangingUserProvider;
15+
1416
class RememberMeTest extends AbstractWebTestCase
1517
{
18+
protected function setUp(): void
19+
{
20+
UserChangingUserProvider::$changePassword = false;
21+
}
22+
1623
/**
1724
* @dataProvider provideConfigs
1825
*/
@@ -51,11 +58,19 @@ public function testUserChangeClearsCookie()
5158

5259
$this->assertSame(302, $client->getResponse()->getStatusCode());
5360
$cookieJar = $client->getCookieJar();
54-
$this->assertNotNull($cookieJar->get('REMEMBERME'));
61+
$this->assertNotNull($cookie = $cookieJar->get('REMEMBERME'));
62+
63+
UserChangingUserProvider::$changePassword = true;
5564

65+
// change password (through user provider), this deauthenticates the session
5666
$client->request('GET', '/profile');
5767
$this->assertRedirect($client->getResponse(), '/login');
5868
$this->assertNull($cookieJar->get('REMEMBERME'));
69+
70+
// restore the old remember me cookie, it should no longer be valid
71+
$cookieJar->set($cookie);
72+
$client->request('GET', '/profile');
73+
$this->assertRedirect($client->getResponse(), '/login');
5974
}
6075

6176
public function testSessionLessRememberMeLogout()
@@ -121,11 +136,19 @@ public function testLegacyUserChangeClearsCookie()
121136

122137
$this->assertSame(302, $client->getResponse()->getStatusCode());
123138
$cookieJar = $client->getCookieJar();
124-
$this->assertNotNull($cookieJar->get('REMEMBERME'));
139+
$this->assertNotNull($cookie = $cookieJar->get('REMEMBERME'));
140+
141+
UserChangingUserProvider::$changePassword = true;
125142

143+
// change password (through user provider), this deauthenticates the session
126144
$client->request('GET', '/profile');
127145
$this->assertRedirect($client->getResponse(), '/login');
128146
$this->assertNull($cookieJar->get('REMEMBERME'));
147+
148+
// restore the old remember me cookie, it should no longer be valid
149+
$cookieJar->set($cookie);
150+
$client->request('GET', '/profile');
151+
$this->assertRedirect($client->getResponse(), '/login');
129152
}
130153

131154
/**

0 commit comments

Comments
 (0)
0