8000 Merge branch '2.7' into 2.8 · symfony/symfony@6d20cee · GitHub
[go: up one dir, main page]
Skip to content

Commit 6d20cee

Browse files
fabpotfabpot
committed
Merge branch '2.7' into 2.8
* 2.7: limited the maximum length of a submitted username
2 parents 766393d + 60bf201 commit 6d20cee

File tree

5 files changed

+90
-0
lines changed

5 files changed

+90
-0
lines changed

‎src/Symfony/Component/Security/Core/Security.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,5 @@ final class Security
2121
const ACCESS_DENIED_ERROR = '_security.403_error';
2222
const AUTHENTICATION_ERROR = '_security.last_error';
2323
const LAST_USERNAME = '_security.last_username';
24+
const MAX_USERNAME_LENGTH = 4096;
2425
}

‎src/Symfony/Component/Security/Core/SecurityContextInterface.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,4 +26,5 @@ interface SecurityContextInterface extends TokenStorageInterface, AuthorizationC
2626
const ACCESS_DENIED_ERROR = Security::ACCESS_DENIED_ERROR;
2727
const AUTHENTICATION_ERROR = Security::AUTHENTICATION_ERROR;
2828
const LAST_USERNAME = Security::LAST_USERNAME;
29+
const MAX_USERNAME_LENGTH = Security::MAX_USERNAME_LENGTH;
2930
}

‎src/Symfony/Component/Security/Http/Firewall/SimpleFormAuthenticationListener.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
use Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface;
2525
use Symfony\Component\Security\Core\Authentication\SimpleFormAuthenticatorInterface;
2626
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
27+
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
2728
use Symfony\Component\Security\Core\Security;
2829
use Symfony\Component\Security\Http\HttpUtils;
2930
use Symfony\Component\Security\Http\ParameterBagUtils;
@@ -127,6 +128,10 @@ protected function attemptAuthentication(Request $request)
127128
$password = ParameterBagUtils::getRequestParameterValue($request, $this->options['password_parameter']);
128129
}
129130

131+
if (strlen($username) > Security::MAX_USERNAME_LENGTH) {
132+
throw new BadCredentialsException('Invalid username.');
133+
}
134+
130135
$request->getSession()->set(Security::LAST_USERNAME, $username);
131136

132137
$token = $this->simpleAuthenticator->createToken($request, $username, $password, $this->providerKey);

‎src/Symfony/Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
use Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface;
2626
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
2727
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
28+
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
2829
use Symfony\Component\Security\Core\Exception\InvalidArgumentException;
2930
use Symfony\Component\Security\Core\Exception\InvalidCsrfTokenException;
3031
use Symfony\Component\Security\Core\Security;
@@ -102,6 +103,10 @@ protected function attemptAuthentication(Request $request)
102103
$password = ParameterBagUtils::getRequestParameterValue($request, $this->options['password_parameter']);
103104
}
104105

106+
if (strlen($username) > Security::MAX_USERNAME_LENGTH) {
107+
throw new BadCredentialsException('Invalid username.');
108+
}
109+
105110
$request->getSession()->set(Security::LAST_USERNAME, $username);
106111

107112
return $this->authenticationManager->authenticate(new UsernamePasswordToken($username, $password, $this->providerKey));

‎src/Symfony/Component/Security/Tests/Http/Firewall/UsernamePasswordFormAuthenticationListenerTest.php

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\Security\Tests\Http\Firewall;
13+
14+
use Symfony\Component\HttpFoundation\Request;
15+
use Symfony\Component\HttpFoundation\Response;
16+
use Symfony\Component\Security\Http\Firewall\UsernamePasswordFormAuthenticationListener;
17+
use Symfony\Component\Security\Core\SecurityContextInterface;
18+
19+
class UsernamePasswordFormAuthenticationListenerTest extends \PHPUnit_Framework_TestCase
20+
{
21+
/**
22+
* @dataProvider getUsernameForLength
23+
*/
24+
public function testHandleWhenUsernameLength($username, $ok)
25+
{
26+
$request = Request::create('/login_check', 'POST', array('_username' => $username));
27+
$request->setSession($this->getMock('Symfony\Component\HttpFoundation\Session\SessionInterface'));
28+
29+
$httpUtils = $this->getMock('Symfony\Component\Security\Http\HttpUtils');
30+
$httpUtils
31+
->expects($this->any())
32+
->method('checkRequestPath')
33+
->will($this->returnValue(true))
34+
;
35+
36+
$failureHandler = $this->getMock('Symfony\Component\Security\Http\Authentication\AuthenticationFailureHandlerInterface');
37+
$failureHandler
38+
->expects($ok ? $this->never() : $this->once())
39+
->method('onAuthenticationFailure')
40+
->will($this->returnValue(new Response()))
41+
;
42+
43+
$authenticationManager = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\AuthenticationProviderManager')->disableOriginalConstructor()->getMock();
44+
$authenticationManager
45+
->expects($ F58A ok ? $this->once() : $this->never())
46+
->method('authenticate')
47+
->will($this->returnValue(new Response()))
48+
;
49+
50+
$listener = new UsernamePasswordFormAuthenticationListener(
51+
$this->getMock('Symfony\Component\Security\Core\SecurityContextInterface'),
52+
$authenticationManager,
53+
$this->getMock('Symfony\Component\Security\Http\Session\SessionAuthenticationStrategyInterface'),
54+
$httpUtils,
55+
'TheProviderKey',
56+
$this->getMock('Symfony\Component\Security\Http\Authentication\AuthenticationSuccessHandlerInterface'),
57+
$failureHandler,
58+
array('require_previous_session' => false)
59+
);
60+
61+
$event = $this->getMock('Symfony\Component\HttpKernel\Event\GetResponseEvent', array(), array(), '', false);
62+
$event
63+
->expects($this->any())
64+
->method('getRequest')
65+
->will($this->returnValue($request))
66+
;
67+
68+
$listener->handle($event);
69+
}
70+
71+
public function getUsernameForLength()
72+
{
73+
return array(
74+
array(str_repeat('x', SecurityContextInterface::MAX_USERNAME_LENGTH + 1), false),
75+
array(str_repeat('x', SecurityContextInterface::MAX_USERNAME_LENGTH - 1), true),
76+
);
77+
}
78+
}

0 commit comments

Comments
 (0)
0