bug #45861 [Serializer] Try all possible denormalization route with union types when ALLOW_EXTRA_ATTRIBUTES=false (T-bond)

nicolas-grekas · nicolas-grekas · commit 0523bd322c9c · 2022-06-19T13:46:09.000+02:00
This PR was squashed before being merged into the 4.4 branch. Discussion ---------- [Serializer] Try all possible denormalization route with union types when ALLOW_EXTRA_ATTRIBUTES=false | Q | A | ------------- | --- | Branch? | 4.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | #45860 | License | MIT | Doc PR | - I found a similar bug, (I think this is a bug, but it is possible, it is an intended behaviour) to my previous report. Commits ------- bd623b9 [Serializer] Try all possible denormalization route with union types when ALLOW_EXTRA_ATTRIBUTES=false
diff --git a/src/Symfony/Component/Serializer/Normalizer/AbstractObjectNormalizer.php b/src/Symfony/Component/Serializer/Normalizer/AbstractObjectNormalizer.php
@@ -370,7 +370,7 @@ public function denormalize($data, $type, $format = null, array $context = [])
             }
         }
 
-        if (!empty($extraAttributes)) {
+        if ($extraAttributes) {
             throw new ExtraAttributesException($extraAttributes);
         }
 
@@ -405,6 +405,7 @@ private function validateAndDenormalize(string $currentClass, string $attribute,
 
         $expectedTypes = [];
         $isUnionType = \count($types) > 1;
+        $extraAttributesException = null;
         foreach ($types as $type) {
             if (null === $data && $type->isNullable()) {
                 return null;
@@ -494,9 +495,21 @@ private function validateAndDenormalize(string $currentClass, string $attribute,
                 if (!$isUnionType) {
                     throw $e;
                 }
+            } catch (ExtraAttributesException $e) {
+                if (!$isUnionType) {
+                    throw $e;
+                }
+
+                if (!$extraAttributesException) {
+                    $extraAttributesException = $e;
+                }
             }
         }
 
+        if ($extraAttributesException) {
+            throw $extraAttributesException;
+        }
+
         if ($context[self::DISABLE_TYPE_ENFORCEMENT] ?? $this->defaultContext[self::DISABLE_TYPE_ENFORCEMENT] ?? false) {
             return $data;
         }
diff --git a/src/Symfony/Component/Serializer/Tests/SerializerTest.php b/src/Symfony/Component/Serializer/Tests/SerializerTest.php
@@ -19,6 +19,7 @@
 use Symfony\Component\Serializer\Encoder\DecoderInterface;
 use Symfony\Component\Serializer\Encoder\EncoderInterface;
 use Symfony\Component\Serializer\Encoder\JsonEncoder;
+use Symfony\Component\Serializer\Exception\ExtraAttributesException;
 use Symfony\Component\Serializer\Exception\InvalidArgumentException;
 use Symfony\Component\Serializer\Exception\LogicException;
 use Symfony\Component\Serializer\Exception\NotNormalizableValueException;
@@ -31,6 +32,7 @@
 use Symfony\Component\Serializer\Mapping\Factory\ClassMetadataFactory;
 use Symfony\Component\Serializer\Mapping\Factory\ClassMetadataFactoryInterface;
 use Symfony\Component\Serializer\Mapping\Loader\AnnotationLoader;
+use Symfony\Component\Serializer\Normalizer\AbstractNormalizer;
 use Symfony\Component\Serializer\Normalizer\AbstractObjectNormalizer;
 use Symfony\Component\Serializer\Normalizer\ArrayDenormalizer;
 use Symfony\Component\Serializer\Normalizer\CustomNormalizer;
@@ -573,6 +575,35 @@ public function testUnionTypeDeserializable()
         $this->assertEquals(new DummyUnionType(), $actual, 'Union type denormalization third case failed.');
     }
 
+    public function testUnionTypeDeserializableWithoutAllowedExtraAttributes()
+    {
+        $classMetadataFactory = new ClassMetadataFactory(new AnnotationLoader(new AnnotationReader()));
+        $extractor = new PropertyInfoExtractor([], [new PhpDocExtractor(), new ReflectionExtractor()]);
+        $serializer = new Serializer(
+            [
+                new ObjectNormalizer($classMetadataFactory, null, null, $extractor, new ClassDiscriminatorFromClassMetadata($classMetadataFactory)),
+            ],
+            ['json' => new JsonEncoder()]
+        );
+
+        $actual = $serializer->deserialize('{ "v": { "a": 0 }}', DummyUnionWithAAndB::class, 'json', [
+            AbstractNormalizer::ALLOW_EXTRA_ATTRIBUTES => false,
+        ]);
+
+        $this->assertEquals(new DummyUnionWithAAndB(new DummyATypeForUnion()), $actual);
+
+        $actual = $serializer->deserialize('{ "v": { "b": 1 }}', DummyUnionWithAAndB::class, 'json', [
+            AbstractNormalizer::ALLOW_EXTRA_ATTRIBUTES => false,
+        ]);
+
+        $this->assertEquals(new DummyUnionWithAAndB(new DummyBTypeForUnion()), $actual);
+
+        $this->expectException(ExtraAttributesException::class);
+        $serializer->deserialize('{ "v": { "b": 1, "c": "i am not allowed" }}', DummyUnionWithAAndB::class, 'json', [
+            AbstractNormalizer::ALLOW_EXTRA_ATTRIBUTES => false,
+        ]);
+    }
+
     /**
      * @requires PHP 8.2
      */
@@ -678,6 +709,30 @@ public function setChanged($changed): self
     }
 }
 
+class DummyATypeForUnion
+{
+    public $a = 0;
+}
+
+class DummyBTypeForUnion
+{
+    public $b = 1;
+}
+
+class DummyUnionWithAAndB
+{
+    /** @var DummyATypeForUnion|DummyBTypeForUnion */
+    public $v;
+
+    /**
+     * @param DummyATypeForUnion|DummyBTypeForUnion $v
+     */
+    public function __construct($v)
+    {
+        $this->v = $v;
+    }
+}
+
 interface NormalizerAwareNormalizer extends NormalizerInterface, NormalizerAwareInterface
 {
 }

Original file line number	Diff line number	Diff line change
`@@ -370,7 +370,7 @@ public function denormalize($data, $type, $format = null, array $context = [])`
`370`	`370`	`}`
`371`	`371`	`}`
`372`	`372`
`373`		`- if (!empty($extraAttributes)) {`
	`373`	`+ if ($extraAttributes) {`
`374`	`374`	`throw new ExtraAttributesException($extraAttributes);`
`375`	`375`	`}`
`376`	`376`
`@@ -405,6 +405,7 @@ private function validateAndDenormalize(string $currentClass, string $attribute,`
`405`	`405`
`406`	`406`	`$expectedTypes = [];`
`407`	`407`	`$isUnionType = \count($types) > 1;`
	`408`	`+ $extraAttributesException = null;`
`408`	`409`	`foreach ($types as $type) {`
`409`	`410`	`if (null === $data && $type->isNullable()) {`
`410`	`411`	`return null;`
`@@ -494,9 +495,21 @@ private function validateAndDenormalize(string $currentClass, string $attribute,`
`494`	`495`	`if (!$isUnionType) {`
`495`	`496`	`throw $e;`
`496`	`497`	`}`
	`498`	`+ } catch (ExtraAttributesException $e) {`
	`499`	`+ if (!$isUnionType) {`
	`500`	`+ throw $e;`
	`501`	`+ }`
	`502`	`+`
	`503`	`+ if (!$extraAttributesException) {`
	`504`	`+ $extraAttributesException = $e;`
	`505`	`+ }`
`497`	`506`	`}`
`498`	`507`	`}`
`499`	`508`
	`509`	`+ if ($extraAttributesException) {`
	`510`	`+ throw $extraAttributesException;`
	`511`	`+ }`
	`512`	`+`
`500`	`513`	`if ($context[self::DISABLE_TYPE_ENFORCEMENT] ?? $this->defaultContext[self::DISABLE_TYPE_ENFORCEMENT] ?? false) {`
`501`	`514`	`return $data;`
`502`	`515`	`}`