[DependencyInjection] Escape parameters before resolving env parameters

MatTheCat · MatTheCat · commit 793143c81d0b · 2025-07-30T16:29:38.000+02:00
diff --git a/src/Symfony/Component/DependencyInjection/ContainerBuilder.php b/src/Symfony/Component/DependencyInjection/ContainerBuilder.php
@@ -777,7 +777,7 @@ public function compile(bool $resolveEnvPlaceholders = false)
 
         if ($bag instanceof EnvPlaceholderParameterBag) {
             if ($resolveEnvPlaceholders) {
-                $this->parameterBag = new ParameterBag($this->resolveEnvPlaceholders($bag->all(), true));
+                $this->parameterBag = new ParameterBag($this->resolveEnvPlaceholders($this->escapeParameters($bag->all()), true));
             }
 
             $this->envPlaceholders = $bag->getEnvPlaceholders();
@@ -1728,4 +1728,20 @@ private function inVendors(string $path): bool
 
         return $this->pathsInVendor[$path] = false;
     }
+
+    private function escapeParameters(array $parameters): array
+    {
+        $params = [];
+        foreach ($parameters as $k => $v) {
+            if (\is_array($v)) {
+                $params[$k] = $this->escapeParameters($v);
+            } elseif (\is_string($v)) {
+                $params[$k] = str_replace('%', '%%', $v);
+            } else {
+                $params[$k] = $v;
+            }
+        }
+
+        return $params;
+    }
 }
diff --git a/src/Symfony/Component/DependencyInjection/Tests/ContainerBuilderTest.php b/src/Symfony/Component/DependencyInjection/Tests/ContainerBuilderTest.php
@@ -884,6 +884,7 @@ public function testCompileWithResolveEnv()
         $container->setParameter('bar', '%% %env(DUMMY_ENV_VAR)% %env(DUMMY_SERVER_VAR)% %env(HTTP_DUMMY_VAR)%');
         $container->setParameter('foo', '%env(FOO)%');
         $container->setParameter('baz', '%foo%');
+        $container->setParameter('qux', '%%quux%%');
         $container->setParameter('env(HTTP_DUMMY_VAR)', '123');
         $container->register('teatime', 'stdClass')
             ->setProperty('foo', '%env(DUMMY_ENV_VAR)%')
