Skip to content

Commit 70f3399

Browse files
fabpotfabpot
committed
[HttpKernel] changed the fragment handler to explicitely disallow non-scalar in generated URIs (refs #8263)
1 parent afd79ea commit 70f3399

File tree

3 files changed

+45
-13
lines changed

3 files changed

+45
-13
lines changed

‎src/Symfony/Component/HttpKernel/Fragment/InlineFragmentRenderer.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ public function render($uri, Request $request, array $options = array())
5252
$reference = null;
5353
if ($uri instanceof ControllerReference) {
5454
$reference = $uri;
55-
$uri = $this->generateFragmentUri($uri, $request);
55+
$uri = $this->generateFragmentUri($uri, $request, false);
5656
}
5757

5858
$subRequest = $this->createSubRequest($uri, $request);

‎src/Symfony/Component/HttpKernel/Fragment/RoutableFragmentRenderer.php‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,12 +40,17 @@ public function setFragmentPath($path)
4040
* Generates a fragment URI for a given controller.
4141
*
4242
* @param ControllerReference $reference A ControllerReference instance
43-
* @param Request $request A Request instance
43+
* @param Request $request A Request instance
44+
* @param Boolean $strict Whether to allow non-scalar attributes or not
4445
*
4546
* @return string A fragment URI
4647
*/
47-
protected function generateFragmentUri(ControllerReference $reference, Request $request)
48+
protected function generateFragmentUri(ControllerReference $reference, Request $request, $strict = true)
4849
{
50+
if ($strict) {
51+
$this->checkNonScalar($reference->attributes);
52+
}
53+
4954
if (!isset($reference->attributes['_format'])) {
5055
$reference->attributes['_format'] = $request->getRequestFormat();
5156
}
@@ -56,4 +61,17 @@ protected function generateFragmentUri(ControllerReference $reference, Request $
5661

5762
return $request->getUriForPath($this->fragmentPath.'?'.http_build_query($reference->query, '', '&'));
5863
}
64+
65+
private function checkNonScalar($values)
66+
{
67+
foreach ($values as $value) {
68+
if (is_array($value)) {
69+
$this->checkNonScalar($value);
70+
}
71+
72+
if (!is_scalar($value)) {
73+
throw new \LogicException('Controller attributes cannot contain non-scalar values.');
74+
}
75+
}
76+
}
5977
}

‎src/Symfony/Component/HttpKernel/Tests/Fragment/RoutableFragmentRendererTest.php‎

Lines changed: 24 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313

1414
use Symfony\Component\HttpFoundation\Request;
1515
use Symfony\Component\HttpKernel\Controller\ControllerReference;
16-
use Symfony\Component\HttpKernel\Fragment\RoutableFragmentRenderer;
1716

1817
class RoutableFragmentRendererTest extends \PHPUnit_Framework_TestCase
1918
{
@@ -22,7 +21,7 @@ class RoutableFragmentRendererTest extends \PHPUnit_Framework_TestCase
2221
*/
2322
public function testGenerateFragmentUri($uri, $controller)
2423
{
25-
$this->assertEquals($uri, $this->getRenderer()->doGenerateFragmentUri($controller, Request::create('/')));
24+
$this->assertEquals($uri, $this->callGenerateFragmentUriMethod($controller, Request::create('/')));
2625
}
2726

2827
public function getGenerateFragmentUriData()
@@ -33,6 +32,7 @@ public function getGenerateFragmentUriData()
3332
array('http://localhost/_fragment?_path=foo%3Dfoo%26_format%3Djson%26_controller%3Dcontroller', new ControllerReference('controller', array('foo' => 'foo', '_format' => 'json'), array())),
3433
array('http://localhost/_fragment?bar=bar&_path=foo%3Dfoo%26_format%3Dhtml%26_controller%3Dcontroller', new ControllerReference('controller', array('foo' => 'foo'), array('bar' => 'bar'))),
3534
array('http://localhost/_fragment?foo=foo&_path=_format%3Dhtml%26_controller%3Dcontroller', new ControllerReference('controller', array(), array('foo' => 'foo'))),
35+
array('http://localhost/_fragment?_path=foo%255B0%255D%3Dfoo%26foo%255B1%255D%3Dbar%26_format%3Dhtml%26_controller%3Dcontroller', new ControllerReference('controller', array('foo' => array('foo', 'bar')), array())),
3636
);
3737
}
3838

@@ -42,22 +42,36 @@ public function testGenerateFragmentUriWithARequest()
4242
$request->attributes->set('_format', 'json');
4343
$controller = new ControllerReference('controller', array(), array());
4444

45-
$this->assertEquals('http://localhost/_fragment?_path=_format%3Djson%26_controller%3Dcontroller', $this->getRenderer()->doGenerateFragmentUri($controller, $request));
45+
$this->assertEquals('http://localhost/_fragment?_path=_format%3Djson%26_controller%3Dcontroller', $this->callGenerateFragmentUriMethod($controller, $request));
4646
}
4747

48-
private function getRenderer()
48+
/**
49+
* @expectedException LogicException
50+
*/
51+
public function testGenerateFragmentUriWithObject()
4952
{
50-
return new Renderer();
53+
$controller = new ControllerReference('controller', array('foo' => new Foo(), 'bar' => 'bar'), array());
54+
55+
$this->callGenerateFragmentUriMethod($controller, Request::create('/'));
56+
}
57+
58+
private function callGenerateFragmentUriMethod(ControllerReference $reference, Request $request)
59+
{
60+
$renderer = $this->getMockForAbstractClass('Symfony\Component\HttpKernel\Fragment\RoutableFragmentRenderer');
61+
$r = new \ReflectionObject($renderer);
62+
$m = $r->getMethod('generateFragmentUri');
63+
$m->setAccessible(true);
64+
65+
return $m->invoke($renderer, $reference, $request);
5166
}
5267
}
5368

54-
class Renderer extends RoutableFragmentRenderer
69+
class Foo
5570
{
56-
public function render($uri, Request $request, array $options = array()) {}
57-
public function getName() {}
71+
public $foo;
5872

59-
public function doGenerateFragmentUri(ControllerReference $reference, Request $request)
73+
public function getFoo()
6074
{
61-
return parent::generateFragmentUri($reference, $request);
75+
return $this->foo;
6276
}
6377
}

0 commit comments

Comments
 (0)