ObjectNormalizer doesn't deal with scope of get() functions correctly
#58041
Comments
|
Hi @vidarl! I'm not sure to understand properly what's wrong. class ObjectDummyWithMagicGetterAndPrivateProperty
{
protected bool $private = true;
public function __get(string $property): mixed
{
throw new \LogicException(sprintf('Cannot call "%s" for $%s private property.', __METHOD__, $property));
}
}
class ObjectDummyWithMagicGetterPrivatePropertyAndGetter
{
protected bool $private = true;
protected function getPrivate(): bool
{
return $this->private;
}
public function __get(string $property): mixed
{
throw new \LogicException(sprintf('Cannot call "%s" for $%s private property.', __METHOD__, $property));
}
}
public function testDoNotCallMagicGetterOnPrivateProperty()
{
$normalizer = new ObjectNormalizer();
$this->assertSame([], $normalizer->normalize(new ObjectDummyWithMagicGetterAndPrivateProperty()));
$this->assertSame([], $normalizer->normalize(new ObjectDummyWithMagicGetterPrivatePropertyAndGetter()));
} |
|
@vidarl try implementing |
|
I am going to close here for now due to the lack of feedback. Please let us know when you have more information and we can consider to reopen. |
|
@stof Looks like isset() is never called either on @mtarld Looks like the problem happens when interacting with the serializer.. |
|
@vidarl, I tried with the following code, and it doesn't seem to fail: <?php
namespace App\Tests;
use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
use Symfony\Component\Serializer\SerializerInterface;
/**
* @group 6.4
*/
final class Issue58041Test extends KernelTestCase
{
public function testBug(): void
{
$normalizer = static::getContainer()->get(SerializerInterface::class);
$this->assertSame([], $normalizer->normalize(new ExampleObject58041WithMagicGetterAndPrivateProperty()));
$this->assertSame([], $normalizer->normalize(new ExampleObject58041WithMagicGetterPrivatePropertyAndGetter()));
}
}
class ExampleObject58041WithMagicGetterAndPrivateProperty
{
protected bool $private = true;
public function __get(string $property): mixed
{
throw new \LogicException(sprintf('Cannot call "%s" for $%s private property.', __METHOD__, $property));
}
}
class ExampleObject58041WithMagicGetterPrivatePropertyAndGetter
{
protected bool $private = true;
protected function getPrivate(): bool
{
return $this->private;
}
public function __get(string $property): mixed
{
throw new \LogicException(sprintf('Cannot call "%s" for $%s private property.', __METHOD__, $property));
}
}I'm wondering if maybe you have a custom normalizer, creating that issue. Could you provide a reproducer Symfony app so that we can take a look, please? |
|
@mtarld Thank you for take the time to look at this.. It works fine on fresh Symfony 7.2. But it does not on fresh Symfony 5.4 which I am currently using. |
|
Unfortunately, we maintain 5.4 for security fixes only. |
|
For anyone else hitting the same bug in 5.4. Even though it is only documented for 6.4 and later, it is also possible to ignore properties in 5.4 as well. This simple code will solve this for the Thank you @Steveb-p for pointing this out to me! |
Symfony version(s) affected
5.4.41 and later (5.4.42 is latest ATM):
Description
Introduced in 5.4.41, the ObjectNormalizer do not take scope of
getfunctions properly. Protected properties will be attempt fetched but not included in the exported data anywayHow to reproduce
The following code will work on 5.4.40 and earlier. Inline comment describes what happens when it fails in 5.4.41 and later :
If I change
__get()to anyway return the propertysomethingProtectedinstead of throwing an exception, it will anyway not be included in the serialized data (which is correct and inline with previous versions )Possible Solution
Problem was introduced by #57187
The change in
Normalizer/ObjectNormalizer.phpin symfony/serializer@296df0c is causing the problemAdditional Context
FYI : #58012 seems to be related
The text was updated successfully, but these errors were encountered: