[SecurityBundle] Fix remember-me cookie framework inheritance when session is disabled

fbourigault · fbourigault · commit af81008cb61b · 2018-11-14T20:14:06.000+01:00
diff --git a/src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php b/src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php
@@ -65,7 +65,7 @@ public function prepend(ContainerBuilder $container)
             return;
         }
         foreach ($container->getExtensionConfig('framework') as $config) {
-            if (isset($config['session'])) {
+            if (isset($config['session']) && \is_array($config['session'])) {
                 $rememberMeSecureDefault = $config['session']['cookie_secure'] ?? $rememberMeSecureDefault;
                 $rememberMeSameSiteDefault = array_key_exists('cookie_samesite', $config['session']) ? $config['session']['cookie_samesite'] : $rememberMeSameSiteDefault;
             }
diff --git a/src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/SecurityExtensionTest.php b/src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/SecurityExtensionTest.php
@@ -12,6 +12,7 @@
 namespace Symfony\Bundle\SecurityBundle\Tests\DependencyInjection;
 
 use PHPUnit\Framework\TestCase;
+use Symfony\Bundle\FrameworkBundle\DependencyInjection\FrameworkExtension;
 use Symfony\Bundle\SecurityBundle\DependencyInjection\SecurityExtension;
 use Symfony\Bundle\SecurityBundle\SecurityBundle;
 use Symfony\Bundle\SecurityBundle\Tests\DependencyInjection\Fixtures\UserProvider\DummyProvider;
@@ -343,6 +344,59 @@ public function testDoNotRegisterTheUserProviderAliasWithMultipleProviders()
         $this->assertFalse($container->has(UserProviderInterface::class));
     }
 
+    /**
+     * @dataProvider sessionConfigurationProvider
+     */
+    public function testRememberMeCookieInheritFrameworkSessionCookie($config, $samesite, $secure)
+    {
+        $container = $this->getRawContainer();
+
+        $container->registerExtension(new FrameworkExtension());
+        $container->setParameter('kernel.bundles_metadata', array());
+        $container->setParameter('kernel.project_dir', __DIR__);
+        $container->setParameter('kernel.root_dir', __DIR__);
+        $container->setParameter('kernel.cache_dir', __DIR__);
+
+        $container->loadFromExtension('security', array(
+            'firewalls' => array(
+                'default' => array(
+                    'form_login' => null,
+                    'remember_me' => array('secret' => 'baz'),
+                ),
+            ),
+        ));
+        $container->loadFromExtension('framework', array(
+            'session' => $config,
+        ));
+
+        $container->compile();
+
+        $definition = $container->getDefinition('security.authentication.rememberme.services.simplehash.default');
+
+        $this->assertEquals($samesite, $definition->getArgument(3)['samesite']);
+        $this->assertEquals($secure, $definition->getArgument(3)['secure']);
+    }
+
+    public function sessionConfigurationProvider()
+    {
+        return array(
+            array(
+                false,
+                null,
+                false,
+            ),
+            array(
+                array(
+                    'cookie_secure' => true,
+                    'cookie_samesite' => 'lax',
+                    'save_path' => null,
+                ),
+                'lax',
+                true,
+            ),
+        );
+    }
+
     protected function getRawContainer()
     {
         $container = new ContainerBuilder();

Original file line number	Diff line number	Diff line change
`@@ -65,7 +65,7 @@ public function prepend(ContainerBuilder $container)`
`65`	`65`	`return;`
`66`	`66`	`}`
`67`	`67`	`foreach ($container->getExtensionConfig('framework') as $config) {`
`68`		`- if (isset($config['session'])) {`
	`68`	`+ if (isset($config['session']) && \is_array($config['session'])) {`
`69`	`69`	`$rememberMeSecureDefault = $config['session']['cookie_secure'] ?? $rememberMeSecureDefault;`
`70`	`70`	`$rememberMeSameSiteDefault = array_key_exists('cookie_samesite', $config['session']) ? $config['session']['cookie_samesite'] : $rememberMeSameSiteDefault;`
`71`	`71`	`}`