[Yaml] Fail properly when the !php/const tag is used in a mapping key

fancyweb · fancyweb · commit 1a71ac4f24a9 · 2020-01-04T14:13:00.000+01:00
diff --git a/src/Symfony/Component/Yaml/Inline.php b/src/Symfony/Component/Yaml/Inline.php
@@ -320,7 +320,11 @@ private static function dumpArray($value, $flags)
      */
     public static function parseScalar($scalar, $flags = 0, $delimiters = null, &$i = 0, $evaluate = true, $references = [], $legacyOmittedKeySupport = false)
     {
-        if (\in_array($scalar[$i], ['"', "'"])) {
+        if ('' === $scalar) {
+            return '';
+        }
+
+        if (isset($scalar[$i]) && \in_array($scalar[$i], ['"', "'"])) {
             // quoted scalar
             $output = self::parseQuotedScalar($scalar, $i);
 
@@ -513,7 +517,7 @@ private static function parseMapping($mapping, $flags, &$i = 0, $references = []
             }
 
             if (!$isKeyQuoted) {
-                $evaluatedKey = self::evaluateScalar($key, $flags, $references);
+                $evaluatedKey = self::evaluateScalar($key, $flags, $references, true);
 
                 if ('' !== $key && $evaluatedKey !== $key && !\is_string($evaluatedKey) && !\is_int($evaluatedKey)) {
                     @trigger_error(self::getDeprecationMessage('Implicit casting of incompatible mapping keys to strings is deprecated since Symfony 3.3 and will throw \Symfony\Component\Yaml\Exception\ParseException in 4.0. Quote your evaluable mapping keys instead.'), E_USER_DEPRECATED);
@@ -611,12 +615,13 @@ private static function parseMapping($mapping, $flags, &$i = 0, $references = []
      * @param string $scalar
      * @param int    $flags
      * @param array  $references
+     * @param bool   $isMappingKey
      *
      * @return mixed The evaluated YAML string
      *
      * @throws ParseException when object parsing support was disabled and the parser detected a PHP object or when a reference could not be resolved
      */
-    private static function evaluateScalar($scalar, $flags, $references = [])
+    private static function evaluateScalar($scalar, $flags, $references = [], $isMappingKey = false)
     {
         $scalar = trim($scalar);
         $scalarLower = strtolower($scalar);
@@ -660,7 +665,7 @@ private static function evaluateScalar($scalar, $flags, $references = [])
                     case 0 === strpos($scalar, '! '):
                         @trigger_error(self::getDeprecationMessage('Using the non-specific tag "!" is deprecated since Symfony 3.4 as its behavior will change in 4.0. It will force non-evaluating your values in 4.0. Use plain integers or !!float instead.'), E_USER_DEPRECATED);
 
-                        return (int) self::parseScalar(substr($scalar, 2), $flags);
+                        return (int) self::parseScalar((string) substr($scalar, 2), $flags);
                     case 0 === strpos($scalar, '!php/object:'):
                         if (self::$objectSupport) {
                             @trigger_error(self::getDeprecationMessage('The !php/object: tag to indicate dumped PHP objects is deprecated since Symfony 3.4 and will be removed in 4.0. Use the !php/object (without the colon) tag instead.'), E_USER_DEPRECATED);
@@ -687,7 +692,7 @@ private static function evaluateScalar($scalar, $flags, $references = [])
                         return null;
                     case 0 === strpos($scalar, '!php/object'):
                         if (self::$objectSupport) {
-                            return unserialize(self::parseScalar(substr($scalar, 12)));
+                            return unserialize(self::parseScalar((string) substr($scalar, 12)));
                         }
 
                         if (self::$exceptionOnInvalidType) {
@@ -712,8 +717,12 @@ private static function evaluateScalar($scalar, $flags, $references = [])
                         return null;
                     case 0 === strpos($scalar, '!php/const'):
                         if (self::$constantSupport) {
+                            if ($isMappingKey) {
+                                throw new ParseException('The !php/const tag is not supported in a mapping key.', self::$parsedLineNumber + 1, $scalar, self::$parsedFilename);
+                            }
+
                             $i = 0;
-                            if (\defined($const = self::parseScalar(substr($scalar, 11), 0, null, $i, false))) {
+                            if (\defined($const = self::parseScalar((string) substr($scalar, 11), 0, null, $i, false))) {
                                 return \constant($const);
                             }
 
@@ -833,7 +842,7 @@ private static function parseTag($value, &$i, $flags)
      */
     public static function evaluateBinaryScalar($scalar)
     {
-        $parsedBinaryData = self::parseScalar(preg_replace('/\s/', '', $scalar));
+        $parsedBinaryData = self::parseScalar(preg_replace('/\s/', '', $scalar) ?: '');
 
         if (0 !== (\strlen($parsedBinaryData) % 4)) {
             throw new ParseException(sprintf('The normalized base64 encoded data (data without whitespace characters) length must be a multiple of four (%d bytes given).', \strlen($parsedBinaryData)), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename);
diff --git a/src/Symfony/Component/Yaml/Tests/InlineTest.php b/src/Symfony/Component/Yaml/Tests/InlineTest.php
@@ -797,4 +797,29 @@ public function getTestsForOctalNumbers()
             'negative octal number' => [-28, '-034'],
         ];
     }
+
+    public function testParseScalarDoesNotFailWithAnEmptyString()
+    {
+        $this->assertSame('', Inline::parseScalar(''));
+    }
+
+    /**
+     * @dataProvider phpConstTagInAMappingKeyThrowsProvider
+     */
+    public function testPhpConstTagInAMappingKeyThrows($extra)
+    {
+        $this->expectException(ParseException::class);
+        $this->expectExceptionMessage('The !php/const tag is not supported in a mapping key at line 1 (near "!php/const").');
+
+        Inline::parse(sprintf('{!php/const%s: foo}', $extra), Yaml::PARSE_CONSTANT);
+    }
+
+    public function phpConstTagInAMappingKeyThrowsProvider()
+    {
+        return [
+            [''],
+            [' '],
+            [' MyConst'],
+        ];
+    }
 }
