Skip to content

[Security] Unset token roles when serializing it and user implements EquatableInterface #59558

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nicolas-grekas merged 1 commit into from
Jan 29, 2025
Merged

[Security] Unset token roles when serializing it and user implements EquatableInterface #59558

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 19 additions & 7 deletions src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@

namespace Symfony\Component\Security\Core\Authentication\Token;

use Symfony\Component\Security\Core\User\EquatableInterface;
use Symfony\Component\Security\Core\User\InMemoryUser;
use Symfony\Component\Security\Core\User\UserInterface;

Expand All @@ -23,24 +24,24 @@
abstract class AbstractToken implements TokenInterface, \Serializable
{
private ?UserInterface $user = null;
private array $roleNames = [];
private array $roleNames;
private array $attributes = [];

/**
* @param string[] $roles An array of roles
*
* @throws \InvalidArgumentException
*/
public function __construct(array $roles = [])
{
$this->roleNames = [];

foreach ($roles as $role) {
$this->roleNames[] = $role;
$this->roleNames[] = (string) $role;
}
}

public function getRoleNames(): array
{
return $this->roleNames;
return $this->roleNames ??= self::__construct($this->user->getRoles()) ?? $this->roleNames;
}

public function getUserIdentifier(): string
Expand Down Expand Up @@ -82,7 +83,13 @@ public function eraseCredentials(): void
*/
public function __serialize(): array
{
return [$this->user, true, null, $this->attributes, $this->roleNames];
$data = [$this->user, true, null, $this->attributes];

if (!$this->user instanceof EquatableInterface) {
$data[] = $this->roleNames;
}

return $data;
}

/**
Expand All @@ -103,7 +110,12 @@ public function __serialize(): array
*/
public function __unserialize(array $data): void
{
[$user, , , $this->attributes, $this->roleNames] = $data;
[$user, , , $this->attributes] = $data;

if (\array_key_exists(4, $data)) {
$this->roleNames = $data[4];
}

$this->user = \is_string($user) ? new InMemoryUser($user, '', $this->roleNames, false) : $user;
}

Expand Down
2 changes: 2 additions & 0 deletions .../Component/Security/Core/Tests/Exception/CustomUserMessageAuthenticationExceptionTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ public function testSharedSerializedData()
$exception->setSafeMessage('message', ['token' => $token]);

$processed = unserialize(serialize($exception));
$this->assertSame($token->getRoleNames(), $processed->getToken()->getRoleNames());
$this->assertEquals($token, $processed->getToken());
$this->assertEquals($token, $processed->getMessageData()['token']);
$this->assertSame($processed->getToken(), $processed->getMessageData()['token']);
Expand All @@ -67,6 +68,7 @@ public function testSharedSerializedDataFromChild()
$exception->setToken($token);

$processed = unserialize(serialize($exception));
$this->assertSame($token->getRoleNames(), $processed->getToken()->getRoleNames());
$this->assertEquals($token, $processed->childMember);
$this->assertEquals($token, $processed->getToken());
$this->assertSame($processed->getToken(), $processed->childMember);
Expand Down
7 changes: 4 additions & 3 deletions src/Symfony/Component/Security/Http/Firewall/ContextListener.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -301,11 +301,12 @@ private static function hasUserChanged(UserInterface $originalUser, TokenInterfa
}
}

$userRoles = array_map('strval', $refreshedUser->getRoles());
$refreshedRoles = array_map('strval', $refreshedUser->getRoles());
$originalRoles = $refreshedToken->getRoleNames(); // This comes from cloning the original token, so it still contains the roles of the original user

if (
\count($userRoles) !== \count($refreshedToken->getRoleNames())
|| \count($userRoles) !== \count(array_intersect($userRoles, $refreshedToken->getRoleNames()))
\count($refreshedRoles) !== \count($originalRoles)
|| \count($refreshedRoles) !== \count(array_intersect($refreshedRoles, $originalRoles))
) {
return true;
}
Expand Down