From d9e1e82e8831536b955ede9bf98cac3949db4dbd Mon Sep 17 00:00:00 2001 From: Nicolas Grekas Date: Mon, 27 Dec 2021 11:29:45 +0100 Subject: [PATCH] [Security] fix unserializing session payloads from v4 --- .../Component/Security/Core/Role/Role.php | 31 +++++++++++++++++++ .../Security/Core/Role/SwitchUserRole.php | 23 ++++++++++++++ .../Core/Tests/Role/LegacyRoleTest.php | 28 +++++++++++++++++ 3 files changed, 82 insertions(+) create mode 100644 src/Symfony/Component/Security/Core/Role/Role.php create mode 100644 src/Symfony/Component/Security/Core/Role/SwitchUserRole.php create mode 100644 src/Symfony/Component/Security/Core/Tests/Role/LegacyRoleTest.php diff --git a/src/Symfony/Component/Security/Core/Role/Role.php b/src/Symfony/Component/Security/Core/Role/Role.php new file mode 100644 index 0000000000000..374eb59fe85ca --- /dev/null +++ b/src/Symfony/Component/Security/Core/Role/Role.php @@ -0,0 +1,31 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Component\Security\Core\Role; + +/** + * Allows migrating session payloads from v4. + * + * @internal + */ +class Role +{ + private $role; + + private function __construct() + { + } + + public function __toString(): string + { + return $this->role; + } +} diff --git a/src/Symfony/Component/Security/Core/Role/SwitchUserRole.php b/src/Symfony/Component/Security/Core/Role/SwitchUserRole.php new file mode 100644 index 0000000000000..6a29fb4daa29b --- /dev/null +++ b/src/Symfony/Component/Security/Core/Role/SwitchUserRole.php @@ -0,0 +1,23 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Component\Security\Core\Role; + +/** + * Allows migrating session payloads from v4. + * + * @internal + */ +class SwitchUserRole extends Role +{ + private $deprecationTriggered; + private $source; +} diff --git a/src/Symfony/Component/Security/Core/Tests/Role/LegacyRoleTest.php b/src/Symfony/Component/Security/Core/Tests/Role/LegacyRoleTest.php new file mode 100644 index 0000000000000..44c9566720b89 --- /dev/null +++ b/src/Symfony/Component/Security/Core/Tests/Role/LegacyRoleTest.php @@ -0,0 +1,28 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Component\Security\Core\Tests\Role; + +use PHPUnit\Framework\TestCase; +use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken; + +class LegacyRoleTest extends TestCase +{ + public function testPayloadFromV4CanBeUnserialized() + { + $serialized = 'C:74:"Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken":236:{a:3:{i:0;N;i:1;s:4:"main";i:2;a:5:{i:0;s:2:"sf";i:1;b:1;i:2;a:1:{i:0;O:41:"Symfony\Component\Security\Core\Role\Role":1:{s:47:"Symfony\Component\Security\Core\Role\Role'."\0".'role'."\0".'";s:9:"ROLE_USER";}}i:3;a:0:{}i:4;a:1:{i:0;s:9:"ROLE_USER";}}}}'; + + $token = unserialize($serialized); + + $this->assertInstanceOf(UsernamePasswordToken::class, $token); + $this->assertSame(['ROLE_USER'], $token->getRoleNames()); + } +} pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.

Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy