[Serializer] Check valid array for callbacks context argument

jewome62 · jewome62 · commit 071b51e53298 · 2019-04-07T14:23:00.000+02:00
[Serializer] Check valid callback for max_depth_handler context argument
diff --git a/src/Symfony/Component/Serializer/Normalizer/AbstractNormalizer.php b/src/Symfony/Component/Serializer/Normalizer/AbstractNormalizer.php
@@ -100,6 +100,10 @@ public function __construct(ClassMetadataFactoryInterface $classMetadataFactory
         $this->defaultContext = array_merge($this->defaultContext, $defaultContext);
 
         if (\array_key_exists(self::CALLBACKS, $this->defaultContext)) {
+            if (!\is_array($this->defaultContext[self::CALLBACKS])) {
+                throw new InvalidArgumentException('The callbacks default context must be a array of callable.');
+            }
+
             foreach ($this->defaultContext[self::CALLBACKS] as $attribute => $callback) {
                 if (!\is_callable($callback)) {
                     throw new InvalidArgumentException(sprintf('The callback given in the default context for attribute "%s" is not callable.', $attribute));
diff --git a/src/Symfony/Component/Serializer/Normalizer/AbstractObjectNormalizer.php b/src/Symfony/Component/Serializer/Normalizer/AbstractObjectNormalizer.php
@@ -59,6 +59,11 @@ abstract class AbstractObjectNormalizer extends AbstractNormalizer
     public function __construct(ClassMetadataFactoryInterface $classMetadataFactory = null, NameConverterInterface $nameConverter = null, PropertyTypeExtractorInterface $propertyTypeExtractor = null, ClassDiscriminatorResolverInterface $classDiscriminatorResolver = null, callable $objectClassResolver = null, array $defaultContext = [])
     {
         parent::__construct($classMetadataFactory, $nameConverter, $defaultContext);
+
+        if (\array_key_exists(self::MAX_DEPTH_HANDLER, $this->defaultContext) && !\is_callable($this->defaultContext[self::MAX_DEPTH_HANDLER])) {
+            throw new InvalidArgumentException(sprintf('The %s given in the default context is not callable.', self::MAX_DEPTH_HANDLER));
+        }
+
         $this->defaultContext[self::EXCLUDE_FROM_CACHE_KEY] = [self::CIRCULAR_REFERENCE_LIMIT_COUNTERS];
 
         $this->propertyTypeExtractor = $propertyTypeExtractor;
@@ -86,7 +91,12 @@ public function normalize($object, $format = null, array $context = [])
         if (!isset($context['cache_key'])) {
             $context['cache_key'] = $this->getCacheKey($format, $context);
         }
+
         if (\array_key_exists(self::CALLBACKS, $context)) {
+            if (!\is_array($context[self::CALLBACKS])) {
+                throw new InvalidArgumentException('The callbacks context must be a array of callable.');
+            }
+
             foreach ($context[self::CALLBACKS] as $attribute => $callback) {
                 if (!\is_callable($callback)) {
                     throw new InvalidArgumentException(sprintf('The callback given in the context for attribute "%s" is not callable.', $attribute));
@@ -105,6 +115,10 @@ public function normalize($object, $format = null, array $context = [])
         $attributesMetadata = $this->classMetadataFactory ? $this->classMetadataFactory->getMetadataFor($class)->getAttributesMetadata() : null;
         $maxDepthHandler = $context[self::MAX_DEPTH_HANDLER] ?? $this->defaultContext[self::MAX_DEPTH_HANDLER] ?? $this->maxDepthHandler;
 
+        if (null !== $maxDepthHandler && !\is_callable($maxDepthHandler)) {
+            throw new InvalidArgumentException(sprintf('The %s given in the context is not callable.', self::MAX_DEPTH_HANDLER));
+        }
+
         foreach ($attributes as $attribute) {
             $maxDepthReached = false;
             if (null !== $attributesMetadata && ($maxDepthReached = $this->isMaxDepthReached($attributesMetadata, $class, $attribute, $context)) && !$maxDepthHandler) {
diff --git a/src/Symfony/Component/Serializer/Tests/Normalizer/ObjectNormalizerTest.php b/src/Symfony/Component/Serializer/Tests/Normalizer/ObjectNormalizerTest.php
@@ -781,7 +781,11 @@ private function createNormalizerWithMaxDepthHandler(callable $handler = null, b
                 $this->normalizer->setMaxDepthHandler($handler);
             }
         } else {
-            $this->createNormalizer([ObjectNormalizer::MAX_DEPTH_HANDLER => $handler], $classMetadataFactory);
+            $context = [];
+            if (null !== $handler) {
+                $context[ObjectNormalizer::MAX_DEPTH_HANDLER] = $handler;
+            }
+            $this->createNormalizer($context, $classMetadataFactory);
         }
         $this->serializer = new Serializer([$this->normalizer]);
         $this->normalizer->setSerializer($this->serializer);

Original file line number	Diff line number	Diff line change
`@@ -781,7 +781,11 @@ private function createNormalizerWithMaxDepthHandler(callable $handler = null, b`
`781`	`781`	`$this->normalizer->setMaxDepthHandler($handler);`
`782`	`782`	`}`
`783`	`783`	`} else {`
`784`		`- $this->createNormalizer([ObjectNormalizer::MAX_DEPTH_HANDLER => $handler], $classMetadataFactory);`
	`784`	`+ $context = [];`
	`785`	`+ if (null !== $handler) {`
	`786`	`+ $context[ObjectNormalizer::MAX_DEPTH_HANDLER] = $handler;`
	`787`	`+ }`
	`788`	`+ $this->createNormalizer($context, $classMetadataFactory);`
`785`	`789`	`}`
`786`	`790`	`$this->serializer = new Serializer([$this->normalizer]);`
`787`	`791`	`$this->normalizer->setSerializer($this->serializer);`