bug #29981 [Security] Complain about an empty decision strategy (corphi)

fabpot · fabpot · commit 68d5597125f6 · 2019-02-21T09:28:33.000+01:00
This PR was merged into the 3.4 branch. Discussion ---------- [Security] Complain about an empty decision strategy | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | - | License | MIT | Doc PR | - When an empty string is passed (or objects with a similarly behaving `__toString()` method) to the constructor, the call to `decide` causes infinite recursion. Commits ------- 3a22cad Fix infinite recursion when passed an empty string
diff --git a/src/Symfony/Component/Security/Core/Authorization/AccessDecisionManager.php b/src/Symfony/Component/Security/Core/Authorization/AccessDecisionManager.php
@@ -43,7 +43,7 @@ class AccessDecisionManager implements AccessDecisionManagerInterface
     public function __construct($voters = [], $strategy = self::STRATEGY_AFFIRMATIVE, $allowIfAllAbstainDecisions = false, $allowIfEqualGrantedDeniedDecisions = true)
     {
         $strategyMethod = 'decide'.ucfirst($strategy);
-        if (!\is_callable([$this, $strategyMethod])) {
+        if ('' === $strategy || !\is_callable([$this, $strategyMethod])) {
             throw new \InvalidArgumentException(sprintf('The strategy "%s" is not supported.', $strategy));
         }
 

Original file line number	Diff line number	Diff line change
`@@ -43,7 +43,7 @@ class AccessDecisionManager implements AccessDecisionManagerInterface`
`43`	`43`	`public function __construct($voters = [], $strategy = self::STRATEGY_AFFIRMATIVE, $allowIfAllAbstainDecisions = false, $allowIfEqualGrantedDeniedDecisions = true)`
`44`	`44`	`{`
`45`	`45`	`$strategyMethod = 'decide'.ucfirst($strategy);`
`46`		`- if (!\is_callable([$this, $strategyMethod])) {`
	`46`	`+ if ('' === $strategy \|\| !\is_callable([$this, $strategyMethod])) {`
`47`	`47`	`throw new \InvalidArgumentException(sprintf('The strategy "%s" is not supported.', $strategy));`
`48`	`48`	`}`
`49`	`49`