[Serializer] fix denormalization of basic property-types in XML and CSV #33849

mkrauser · mkrauser · commit 98105f5c7991 · 2019-10-24T14:19:00.000+02:00
diff --git a/src/Symfony/Component/Serializer/Normalizer/AbstractObjectNormalizer.php b/src/Symfony/Component/Serializer/Normalizer/AbstractObjectNormalizer.php
@@ -256,21 +256,30 @@ private function validateAndDenormalize($currentClass, $attribute, $data, $forma
 
             // In XML and CSV all basic datatypes are represented as strings, it is e.g. not possible to determine,
             // if a value is meant to be a string, float, int or a boolean value from the serialized representation.
-            // That's why we have to transform the values, if one of these non-string basic datatypes is epxected.
+            // That's why we have to transform the values, if one of these non-string basic datatypes is expected.
             //
             // This is special to xml and csv format
             if (
                 \is_string($data) &&
-                (XmlEncoder::FORMAT === $format || CsvEncoder::FORMAT === $format) &&
-                \in_array($type->getBuiltinType(), [Type::BUILTIN_TYPE_BOOL, Type::BUILTIN_TYPE_INT, Type::BUILTIN_TYPE_FLOAT], true)
+                (XmlEncoder::FORMAT === $format || CsvEncoder::FORMAT === $format)
             ) {
+                if (
+                    '' === $data &&
+                    $type->isNullable() &&
+                    \in_array($type->getBuiltinType(), [Type::BUILTIN_TYPE_BOOL, Type::BUILTIN_TYPE_INT, Type::BUILTIN_TYPE_FLOAT], true)
+                ) {
+                    return null;
+                }
+
                 switch ($type->getBuiltinType()) {
                     case Type::BUILTIN_TYPE_BOOL:
                         // according to https://www.w3.org/TR/xmlschema-2/#boolean, valid representations are "false", "true", "0" and "1"
                         if ('false' === $data || '0' === $data) {
                             $data = false;
                         } elseif ('true' === $data || '1' === $data) {
                             $data = true;
+                        } else {
+                            throw new NotNormalizableValueException(sprintf('The type of the "%s" attribute for class "%s" must be bool ("%s" given).', $attribute, $currentClass, $data));
                         }
                         break;
                     case Type::BUILTIN_TYPE_INT:
@@ -279,23 +288,23 @@ private function validateAndDenormalize($currentClass, $attribute, $data, $forma
                             '-' == $data[0] && ctype_digit(substr($data, 1))
                         ) {
                             $data = (int) $data;
+                        } else {
+                            throw new NotNormalizableValueException(sprintf('The type of the "%s" attribute for class "%s" must be int ("%s" given).', $attribute, $currentClass, $data));
                         }
                         break;
                     case Type::BUILTIN_TYPE_FLOAT:
                         if (is_numeric($data)) {
-                            return '0x' === $data[0].$data[1] ? hexdec($data) : (float) $data;
+                            return (float) $data;
                         }
-                        if (
-                            ctype_digit($data) ||
-                            '-' == $data[0] && ctype_digit(substr($data, 1))
-                        ) {
-                            $data = (int) $data;
-                        } elseif ('NaN' === $data) {
+
+                        if ('NaN' === $data) {
                             return NAN;
                         } elseif ('INF') {
                             return INF;
                         } elseif ('-INF') {
                             return -INF;
+                        } else {
+                            throw new NotNormalizableValueException(sprintf('The type of the "%s" attribute for class "%s" must be float ("%s" given).', $attribute, $currentClass, $data));
                         }
 
                         break;
@@ -453,10 +462,10 @@ private function getCacheKey($format, array $context)
         unset($context['cache_key']); // avoid artificially different keys
         try {
             return md5($format.serialize([
-                'context' => $context,
-                'ignored' => $this->ignoredAttributes,
-                'camelized' => $this->camelizedAttributes,
-            ]));
+                    'context' => $context,
+                    'ignored' => $this->ignoredAttributes,
+                    'camelized' => $this->camelizedAttributes,
+                ]));
         } catch (\Exception $exception) {
             // The context cannot be serialized, skip the cache
             return false;
