bug #62482 [DependencyInjection] Fix loose validation in #[Autowire] attribute (yoeunes)

fabpot · fabpot · commit d0015c2d8f4e · 2025-11-29T09:09:33.000+01:00
This PR was merged into the 6.4 branch. Discussion ---------- [DependencyInjection] Fix loose validation in `#[Autowire]` attribute | Q | A | ------------- | --- | Branch? | 6.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Issues | - | License | MIT The `Autowire` attribute uses a chain of `xor` conditions to ensure that only one of `$value`, `$service`, `$expression`, `$env`, or `$param` is passed. However, `xor` is pairwise associative. If **three** of these arguments are passed, the expression evaluates to `true` (`(true ^ true) ^ true === true`), and the validation passes incorrectly. Commits ------- f0a2f56 [DependencyInjection] Fix loose validation in #[Autowire] attribute
diff --git a/src/Symfony/Component/DependencyInjection/Attribute/Autowire.php b/src/Symfony/Component/DependencyInjection/Attribute/Autowire.php
@@ -52,7 +52,7 @@ public function __construct(
             if (null !== $value && null !== $service) {
                 throw new LogicException('#[Autowire] attribute cannot declare $value and $service at the same time.');
             }
-        } elseif (!(null !== $value xor null !== $service xor null !== $expression xor null !== $env xor null !== $param)) {
+        } elseif (1 !== (null !== $value) + (null !== $service) + (null !== $expression) + (null !== $env) + (null !== $param)) {
             throw new LogicException('#[Autowire] attribute must declare exactly one of $service, $expression, $env, $param or $value.');
         }
 
diff --git a/src/Symfony/Component/DependencyInjection/Tests/Attribute/AutowireTest.php b/src/Symfony/Component/DependencyInjection/Tests/Attribute/AutowireTest.php
@@ -82,4 +82,24 @@ public static function provideMultipleParameters(): iterable
 
         yield [['value' => 'some-value', 'expression' => 'expr']];
     }
+
+    /**
+     * @dataProvider provideMutuallyExclusiveOptions
+     */
+    public function testConstructThrowsOnMutuallyExclusiveOptions(array $parameters)
+    {
+        $this->expectException(LogicException::class);
+        $this->expectExceptionMessage('#[Autowire] attribute must declare exactly one of $service, $expression, $env, $param or $value.');
+
+        new Autowire(...$parameters);
+    }
+
+    public static function provideMutuallyExclusiveOptions(): iterable
+    {
+        yield [[]];
+        yield [['value' => 'some-value', 'service' => 'id']];
+        yield [['value' => 'some-value', 'service' => 'id', 'expression' => 'expr']];
+        yield [['value' => 'some-value', 'service' => 'id', 'expression' => 'expr', 'env' => 'ENV']];
+        yield [['value' => 'some-value', 'service' => 'id', 'expression' => 'expr', 'env' => 'ENV', 'param' => 'param']];
+    }
 }

Original file line number	Diff line number	Diff line change
`@@ -52,7 +52,7 @@ public function __construct(`
`52`	`52`	`if (null !== $value && null !== $service) {`
`53`	`53`	`throw new LogicException('#[Autowire] attribute cannot declare $value and $service at the same time.');`
`54`	`54`	`}`
`55`		`- } elseif (!(null !== $value xor null !== $service xor null !== $expression xor null !== $env xor null !== $param)) {`
	`55`	`+ } elseif (1 !== (null !== $value) + (null !== $service) + (null !== $expression) + (null !== $env) + (null !== $param)) {`
`56`	`56`	`throw new LogicException('#[Autowire] attribute must declare exactly one of $service, $expression, $env, $param or $value.');`
`57`	`57`	`}`
`58`	`58`