symfony · chalasr · Apr 17, 2025 · Apr 15, 2025
diff --git a/src/Symfony/Bundle/FrameworkBundle/Resources/config/services.php b/src/Symfony/Bundle/FrameworkBundle/Resources/config/services.php
@@ -158,6 +158,9 @@ class_exists(WorkflowEvents::class) ? WorkflowEvents::ALIASES : []
         ->set('uri_signer', UriSigner::class)
             ->args([
                 new Parameter('kernel.secret'),
+                '_hash',
+                '_expiration',
+                service('clock')->nullOnInvalid(),
             ])
             ->lazy()
         ->alias(UriSigner::class, 'uri_signer')

diff --git a/src/Symfony/Component/HttpFoundation/CHANGELOG.md b/src/Symfony/Component/HttpFoundation/CHANGELOG.md
@@ -8,6 +8,7 @@ CHANGELOG
  * Add `EventStreamResponse` and `ServerEvent` classes to streamline server event streaming
  * Add support for `valkey:` / `valkeys:` schemes for sessions
  * `Request::getPreferredLanguage()` now favors a more preferred language above exactly matching a locale
+ * Allow `UriSigner` to use a `ClockInterface`
 
 7.2
 ---

diff --git a/src/Symfony/Component/HttpFoundation/Tests/UriSignerTest.php b/src/Symfony/Component/HttpFoundation/Tests/UriSignerTest.php
@@ -12,6 +12,7 @@
 namespace Symfony\Component\HttpFoundation\Tests;
 
 use PHPUnit\Framework\TestCase;
+use Symfony\Component\Clock\MockClock;
 use Symfony\Component\HttpFoundation\Exception\LogicException;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\UriSigner;
@@ -199,6 +200,29 @@ public function testCheckWithUriExpiration()
         $this->assertFalse($signer->check($relativeUriFromNow3));
     }
 
+    public function testCheckWithUriExpirationWithClock()
+    {
+        $clock = new MockClock();
+        $signer = new UriSigner('foobar', clock: $clock);
+
+        $this->assertFalse($signer->check($signer->sign('http://example.com/foo', new \DateTimeImmutable('2000-01-01 00:00:00'))));
+        $this->assertFalse($signer->check($signer->sign('http://example.com/foo?foo=bar', new \DateTimeImmutable('2000-01-01 00:00:00'))));
+        $this->assertFalse($signer->check($signer->sign('http://example.com/foo?foo=bar&0=integer', new \DateTimeImmutable('2000-01-01 00:00:00'))));
+
+        $this->assertFalse($signer->check($signer->sign('http://example.com/foo', 1577836800))); // 2000-01-01
+        $this->assertFalse($signer->check($signer->sign('http://example.com/foo?foo=bar', 1577836800))); // 2000-01-01
+        $this->assertFalse($signer->check($signer->sign('http://example.com/foo?foo=bar&0=integer', 1577836800))); // 2000-01-01
+
+        $relativeUriFromNow1 = $signer->sign('http://example.com/foo', new \DateInterval('PT3S'));
+        $relativeUriFromNow2 = $signer->sign('http://example.com/foo?foo=bar', new \DateInterval('PT3S'));
+        $relativeUriFromNow3 = $signer->sign('http://example.com/foo?foo=bar&0=integer', new \DateInterval('PT3S'));
+        $clock->sleep(10);
+
+        $this->assertFalse($signer->check($relativeUriFromNow1));
+        $this->assertFalse($signer->check($relativeUriFromNow2));
+        $this->assertFalse($signer->check($relativeUriFromNow3));
+    }
+
     public function testNonUrlSafeBase64()
     {
         $signer = new UriSigner('foobar');

diff --git a/src/Symfony/Component/HttpFoundation/UriSigner.php b/src/Symfony/Component/HttpFoundation/UriSigner.php
@@ -11,6 +11,7 @@
 
 namespace Symfony\Component\HttpFoundation;
 
+use Psr\Clock\ClockInterface;
 use Symfony\Component\HttpFoundation\Exception\LogicException;
 
 /**
@@ -26,6 +27,7 @@
         #[\SensitiveParameter] private string $secret,
         private string $hashParameter = '_hash',
         private string $expirationParameter = '_expiration',
+        private ?ClockInterface $clock = null,
     ) {
         if (!$secret) {
             throw new \InvalidArgumentException('A non-empty secret is required.');
@@ -109,7 +111,7 @@
         }
 
         if ($expiration = $params[$this->expirationParameter] ?? false) {
-            return time() < $expiration;
+            return $this->now()->getTimestamp() < $expiration;
         }
 
         return true;
@@ -153,9 +155,14 @@
         }
 
         if ($expiration instanceof \DateInterval) {
-            return \DateTimeImmutable::createFromFormat('U', time())->add($expiration)->format('U');
+            return $this->now()->add($expiration)->format('U');
         }
 
         return (string) $expiration;
     }
+
+    private function now(): \DateTimeImmutable
+    {
+        return $this->clock?->now() ?? \DateTimeImmutable::createFromFormat('U', time());
+    }
 }
diff --git a/src/Symfony/Component/HttpFoundation/composer.json b/src/Symfony/Component/HttpFoundation/composer.json
@@ -25,6 +25,7 @@
         "doctrine/dbal": "^3.6|^4",
         "predis/predis": "^1.1|^2.0",
         "symfony/cache": "^6.4.12|^7.1.5",
+        "symfony/clock": "^6.4|^7.0",
         "symfony/dependency-injection": "^6.4|^7.0",
         "symfony/http-kernel": "^6.4|^7.0",
         "symfony/mime": "^6.4|^7.0",