fix(security): ensure the 'route' index is set before attempting to use it

gsdevme · fabpot · commit 7ae578cc1aca · 2017-07-20T09:38:09.000+02:00
diff --git a/src/Symfony/Component/Security/Http/HttpUtils.php b/src/Symfony/Component/Security/Http/HttpUtils.php
@@ -108,7 +108,7 @@ public function checkRequestPath(Request $request, $path)
                     $parameters = $this->urlMatcher->match($request->getPathInfo());
                 }
 
-                return $path === $parameters['_route'];
+                return isset($parameters['_route']) && $path === $parameters['_route'];
             } catch (MethodNotAllowedException $e) {
                 return false;
             } catch (ResourceNotFoundException $e) {
diff --git a/src/Symfony/Component/Security/Http/Tests/HttpUtilsTest.php b/src/Symfony/Component/Security/Http/Tests/HttpUtilsTest.php
@@ -221,6 +221,19 @@ public function testCheckRequestPathWithUrlMatcherLoadingException()
         $utils->checkRequestPath($this->getRequest(), 'foobar');
     }
 
+    public function testCheckPathWithoutRouteParam()
+    {
+        $urlMatcher = $this->getMockBuilder('Symfony\Component\Routing\Matcher\UrlMatcherInterface')->getMock();
+        $urlMatcher
+            ->expects($this->any())
+            ->method('match')
+            ->willReturn(array('_controller' => 'PathController'))
+        ;
+
+        $utils = new HttpUtils(null, $urlMatcher);
+        $this->assertFalse($utils->checkRequestPath($this->getRequest(), 'path/index.html'));
+    }
+
     /**
      * @expectedException \InvalidArgumentException
      * @expectedExceptionMessage Matcher must either implement UrlMatcherInterface or RequestMatcherInterface

Original file line number	Diff line number	Diff line change
`@@ -108,7 +108,7 @@ public function checkRequestPath(Request $request, $path)`
`108`	`108`	`$parameters = $this->urlMatcher->match($request->getPathInfo());`
`109`	`109`	`}`
`110`	`110`
`111`		`- return $path === $parameters['_route'];`
	`111`	`+ return isset($parameters['_route']) && $path === $parameters['_route'];`
`112`	`112`	`} catch (MethodNotAllowedException $e) {`
`113`	`113`	`return false;`
`114`	`114`	`} catch (ResourceNotFoundException $e) {`