bug #34383 [DI] Use reproducible entropy to generate env placeholders (nicolas-grekas)

fabpot · fabpot · commit 8522a88185a7 · 2019-11-15T13:45:44.000+01:00
This PR was merged into the 4.3 branch. Discussion ---------- [DI] Use reproducible entropy to generate env placeholders | Q | A | ------------- | --- | Branch? | 4.3 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | - | License | MIT | Doc PR | - Bound arguments typically reference env vars, which are turned into random placeholders right now. When this randomness is used in a hash to generate the internal name of a service locator, the hash is totally random. This breaks reproducible builds. This PR replaces true randomness with reproducible entropy. Commits ------- 600ae33 [DI] Use reproducible entropy to generate env placeholders
diff --git a/src/Symfony/Component/DependencyInjection/ParameterBag/EnvPlaceholderParameterBag.php b/src/Symfony/Component/DependencyInjection/ParameterBag/EnvPlaceholderParameterBag.php
@@ -24,6 +24,8 @@ class EnvPlaceholderParameterBag extends ParameterBag
     private $unusedEnvPlaceholders = [];
     private $providedTypes = [];
 
+    private static $counter = 0;
+
     /**
      * {@inheritdoc}
      */
@@ -57,7 +59,7 @@ public function get($name)
                 }
             }
 
-            $uniqueName = md5($name.uniqid(mt_rand(), true));
+            $uniqueName = md5($name.'_'.self::$counter++);
             $placeholder = sprintf('%s_%s_%s', $this->getEnvPlaceholderUniquePrefix(), str_replace(':', '_', $env), $uniqueName);
             $this->envPlaceholders[$env][$placeholder] = $placeholder;
 
@@ -72,7 +74,13 @@ public function get($name)
      */
     public function getEnvPlaceholderUniquePrefix(): string
     {
-        return $this->envPlaceholderUniquePrefix ?? $this->envPlaceholderUniquePrefix = 'env_'.bin2hex(random_bytes(8));
+        if (null === $this->envPlaceholderUniquePrefix) {
+            $reproducibleEntropy = unserialize(serialize($this->parameters));
+            array_walk_recursive($reproducibleEntropy, function (&$v) { $v = null; });
+            $this->envPlaceholderUniquePrefix = 'env_'.substr(md5(serialize($reproducibleEntropy)), -16);
+        }
+
+        return $this->envPlaceholderUniquePrefix;
     }
 
     /**
