-
-
Notifications
You must be signed in to change notification settings - Fork 9.8k
Closed
Description
Symfony version(s) affected
5.4 & others
Description
Some production setups set disable_functions to include var_dump (and exec, shell_exec, phpinfo, etc) for security purposes. This means that var_dump() may not be always be callable. This becomes relevant here:
symfony/src/Symfony/Component/HttpClient/HttpClientTrait.php
Lines 123 to 126 in 2633877
| // Validate on_progress | |
| if (!\is_callable($onProgress = $options['on_progress'] ?? 'var_dump')) { | |
| throw new InvalidArgumentException(sprintf('Option "on_progress" must be callable, "%s" given.', get_debug_type($onProgress))); | |
| } |
The most common case is that on_progress is not set, so is_callable('var_dump') is the most common pattern.
This is a problem from PHP 8.0+ because the behaviour changed for is_callable('var_dump') when the function is disabled.
How to reproduce
$ # PHP 7.4
$ php -d'disable_functions=var_dump' -r 'var_export(is_callable("var_dump"));'
true
$ # PHP 8.0
$ php -d'disable_functions=var_dump' -r 'var_export(is_callable("var_dump"));'
false
Possible Solution
Perhaps switch var_dump to something innocuous like is_int?
Additional Context
No response
ro0NL