8000 [Security] Fix fatal error on non string username · symfony/symfony@9da049f · GitHub
[go: up one dir, main page]
Skip to content

Commit 9da049f

Browse files
author
Robin Chalas
committed
[Security] Fix fatal error on non string username
1 parent 28485af commit 9da049f

File tree

3 files changed

+55
-12
lines changed

3 files changed

+55
-12
lines changed

‎src/Symfony/Component/Security/Http/Firewall/SimpleFormAuthenticationListener.php

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
use Symfony\Component\Form\Extension\Csrf\CsrfProvider\CsrfProviderAdapter;
1616
use Symfony\Component\Form\Extension\Csrf\CsrfProvider\CsrfProviderInterface;
1717
use Symfony\Component\HttpFoundation\Request;
18+
use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
1819
use Symfony\Component\Security\Core\Exception\InvalidArgumentException;
1920
use Symfony\Component\Security\Core\Exception\InvalidCsrfTokenException;
2021
use Symfony\Component\Security\Csrf\CsrfToken;
@@ -107,14 +108,16 @@ protected function attemptAuthentication(Request $request)
107108
}
108109
}
109110

110-
if ($this->options['post_only']) {
111-
$username = trim($request->request->get($this->options['username_parameter'], null, true));
112-
$password = $request->request->get($this->options['password_parameter'], null, true);
113-
} else {
114-
$username = trim($request->get($this->options['username_parameter'], null, true));
115-
$password = $request->get($this->options['password_parameter'], null, true);
111+
$requestBag = $this->options['post_only'] ? $request->request : $request;
112+
$username = $requestBag->get($this->options['username_parameter'], null, true);
113+
$password = $requestBag->get($this->options['password_parameter'], null, true);
114+
115+
if (!is_string($username)) {
116+
throw new BadRequestHttpException(sprintf('The key "%s" must be a string.', $this->options['username_parameter']));
116117
}
117118

119+
$username = trim($username);
120+
118121
if (strlen($username) > Security::MAX_USERNAME_LENGTH) {
119122
throw new BadCredentialsException('Invalid username.');
120123
}

‎src/Symfony/Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
use Symfony\Component\Form\Extension\Csrf\CsrfProvider\CsrfProviderInterface;
1616
use Symfony\Component\HttpFoundation\Request;
1717
use Psr\Log\LoggerInterface;
18+
use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
1819
use Symfony\Component\Security\Csrf\CsrfToken;
1920
use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
2021
use Symfony\Component\Security\Http\Authentication\AuthenticationFailureHandlerInterface;
@@ -84,14 +85,16 @@ protected function attemptAuthentication(Request $request)
8485
}
8586
}
8687

87-
if ($this->options['post_only']) {
88-
$username = trim($request->request->get($this->options['username_parameter'], null, true));
89-
$password = $request->request->get($this->options['password_parameter'], null, true);
90-
} else {
91-
$username = trim($request->get($this->options['username_parameter'], null, true));
92-
$password = $request->get($this->options['password_parameter'], null, true);
88+
$requestBag = $this->options['post_only'] ? $request->request : $request;
89+
$username = $requestBag->get($this->options['username_parameter'], null, true);
90+
$password = $requestBag->get($this->options['password_parameter'], null, true);
91+
92+
if (!is_string($username)) {
93+
throw new BadRequestHttpException(sprintf('The key "%s" must be a string.', $this->options['username_parameter']));
9394
}
9495

96+
$username = trim($username);
97+
9598
if (strlen($username) > Security::MAX_USERNAME_LENGTH) {
9699
throw new BadCredentialsException('Invalid username.');
97100
}

‎src/Symfony/Component/Security/Http/Tests/Firewall/UsernamePasswordFormAuthenticationListenerTest.php

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,15 @@
1414
use PHPUnit\Framework\TestCase;
1515
use Symfony\Component\HttpFoundation\Request;
1616
use Symfony\Component\HttpFoundation\Response;
17+
use Symfony\Component\HttpFoundation\Session\Session;
18+
use Symfony\Component\Security\Core\Authentication\AuthenticationProviderManager;
19+
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage;
20+
use Symfony\Component\Security\Http\Authentication\DefaultAuthenticationFailureHandler;
21+
use Symfony\Component\Security\Http\Authentication\DefaultAuthenticationSuccessHandler;
1722
use Symfony\Component\Security\Http\Firewall\UsernamePasswordFormAuthenticationListener;
1823
use Symfony\Component\Security\Core\SecurityContextInterface;
24+
use Symfony\Component\Security\Http\HttpUtils;
25+
use Symfony\Component\Security\Http\Session\SessionAuthenticationStrategy;
1926

2027
class UsernamePasswordFormAuthenticationListenerTest extends TestCase
2128
{
@@ -69,6 +76,36 @@ public function testHandleWhenUsernameLength($username, $ok)
6976
$listener->handle($event);
7077
}
7178

79+
/**
80+
* @expectedException \Symfony\Component\HttpKernel\Exception\BadRequestHttpException
81+
* @expectedExceptionMessage The key "_username" must be a string.
82+
*/
83+
public function testHandleNonStringUsername()
84+
{
85+
$request = Request::create('/login_check', 'POST', array('_username' => array()));
86+
$request->setSession(new Session());
87+
88+
$listener = new UsernamePasswordFormAuthenticationListener(
89+
new TokenStorage(),
90+
$this->getMockBuilder('Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface')->getMock(),
91+
new SessionAuthenticationStrategy(SessionAuthenticationStrategy::NONE),
92+
$httpUtils = new HttpUtils(),
93+
'foo',
94+
new DefaultAuthenticationSuccessHandler($httpUtils),
95+
new DefaultAuthenticationFailureHandler($this->getMockBuilder('Symfony\Component\HttpKernel\HttpKernelInterface')->getMock(), $httpUtils),
96+
array('require_previous_session' => false)
97+
);
98+
99+
$event = $this->getMockBuilder('Symfony\Component\HttpKernel\Event\GetResponseEvent')->disableOriginalConstructor()->getMock();
100+
$event
101+
->expects($this->any())
102+
->method('getRequest')
103+
->will($this->returnValue($request))
104+
;
105+
106+
$listener->handle($event);
107+
}
108+
72109
public function getUsernameForLength()
73110
{
74111
return array(

0 commit comments

Comments
 (0)
0