Merge branch '5.0'

nicolas-grekas · nicolas-grekas · commit be93a222e431 · 2020-05-16T11:12:54.000+02:00
* 5.0: [VarDumper] fix for change in PHP 7.4.6 Added regression test for AccountStatusException behavior (ref #36822) [HttpClient] fix PHP warning + accept status code >= 600 [Security/Core] fix compat of `NativePasswordEncoder` with pre-PHP74 values of `PASSWORD_*` consts embed resource name in error message [FrameworkBundle] fix stringable annotation Change priority of KernelEvents::RESPONSE subscriber Fix register event listeners compiler pass Missing description in `messenger:setup-transports` command [Serializer] fix issue with PHP 8 [WebProfiler] Remove 'none' when appending CSP tokens [TwigBundle] FormExtension does not have a constructor anymore since sf 4.0 [Yaml] Fix escaped quotes in quoted multi-line string
diff --git a/src/Symfony/Bundle/FrameworkBundle/Secrets/SodiumVault.php b/src/Symfony/Bundle/FrameworkBundle/Secrets/SodiumVault.php
@@ -28,8 +28,8 @@ class SodiumVault extends AbstractVault implements EnvVarLoaderInterface
     private $secretsDir;
 
     /**
-     * @param string|object|null $decryptionKey A string or a stringable object that defines the private key to use to decrypt the vault
-     *                                          or null to store generated keys in the provided $secretsDir
+     * @param string|\Stringable|null $decryptionKey A string or a stringable object that defines the private key to use to decrypt the vault
+     *                                               or null to store generated keys in the provided $secretsDir
      */
     public function __construct(string $secretsDir, $decryptionKey = null)
     {
diff --git a/src/Symfony/Bundle/TwigBundle/Resources/config/form.xml b/src/Symfony/Bundle/TwigBundle/Resources/config/form.xml
@@ -6,12 +6,7 @@
     <services>
         <defaults public="false" />
 
-        <service id="twig.extension.form" class="Symfony\Bridge\Twig\Extension\FormExtension">
-            <argument type="collection">
-                <argument type="service" id="service_container" />
-                <argument>twig.form.renderer</argument>
-            </argument>
-        </service>
+        <service id="twig.extension.form" class="Symfony\Bridge\Twig\Extension\FormExtension" />
 
         <service id="twig.form.engine" class="Symfony\Bridge\Twig\Form\TwigRendererEngine">
             <argument>%twig.form.resources%</argument>
diff --git a/src/Symfony/Bundle/WebProfilerBundle/Csp/ContentSecurityPolicyHandler.php b/src/Symfony/Bundle/WebProfilerBundle/Csp/ContentSecurityPolicyHandler.php
@@ -133,6 +133,12 @@ private function updateCspHeaders(Response $response, array $nonces = []): array
                         continue;
                     }
 
+                    if (['\'none\''] === $fallback) {
+                        // Fallback came from "default-src: 'none'"
+                        // 'none' is invalid if it's not the only expression in the source list, so we leave it out
+                        $fallback = [];
+                    }
+
                     $headers[$header][$type] = $fallback;
                 }
                 $ruleIsSet = true;
diff --git a/src/Symfony/Bundle/WebProfilerBundle/Tests/Csp/ContentSecurityPolicyHandlerTest.php b/src/Symfony/Bundle/WebProfilerBundle/Tests/Csp/ContentSecurityPolicyHandlerTest.php
@@ -140,6 +140,13 @@ public function provideRequestAndResponsesForOnKernelResponse()
                 $this->createResponse(['Content-Security-Policy' => 'default-src \'self\' domain.com; script-src \'self\' \'unsafe-inline\'; script-src-elem \'self\'; style-src \'self\' \'unsafe-inline\'; style-src-elem \'self\'', 'Content-Security-Policy-Report-Only' => 'default-src \'self\' domain-report-only.com; script-src \'self\' \'unsafe-inline\'; script-src-elem \'self\'; style-src \'self\' \'unsafe-inline\'; style-src-elem \'self\'']),
                 ['Content-Security-Policy' => 'default-src \'self\' domain.com; script-src \'self\' \'unsafe-inline\'; script-src-elem \'self\' \'unsafe-inline\' \'nonce-'.$nonce.'\'; style-src \'self\' \'unsafe-inline\'; style-src-elem \'self\' \'unsafe-inline\' \'nonce-'.$nonce.'\'', 'Content-Security-Policy-Report-Only' => 'default-src \'self\' domain-report-only.com; script-src \'self\' \'unsafe-inline\'; script-src-elem \'self\' \'unsafe-inline\' \'nonce-'.$nonce.'\'; style-src \'self\' \'unsafe-inline\'; style-src-elem \'self\' \'unsafe-inline\' \'nonce-'.$nonce.'\'', 'X-Content-Security-Policy' => null],
             ],
+            [
+                $nonce,
+                ['csp_script_nonce' => $nonce, 'csp_style_nonce' => $nonce],
+                $this->createRequest(),
+                $this->createResponse(['Content-Security-Policy' => 'default-src \'none\'', 'Content-Security-Policy-Report-Only' => 'default-src \'none\'']),
+                ['Content-Security-Policy' => 'default-src \'none\'; script-src \'unsafe-inline\' \'nonce-'.$nonce.'\'; style-src \'unsafe-inline\' \'nonce-'.$nonce.'\'', 'Content-Security-Policy-Report-Only' => 'default-src \'none\'; script-src \'unsafe-inline\' \'nonce-'.$nonce.'\'; style-src \'unsafe-inline\' \'nonce-'.$nonce.'\'', 'X-Content-Security-Policy' => null],
+            ],
             [
                 $nonce,
                 ['csp_script_nonce' => $nonce, 'csp_style_nonce' => $nonce],
diff --git a/src/Symfony/Component/EventDispatcher/DependencyInjection/RegisterListenersPass.php b/src/Symfony/Component/EventDispatcher/DependencyInjection/RegisterListenersPass.php
@@ -71,12 +71,12 @@ public function process(ContainerBuilder $container)
             return;
         }
 
+        $aliases = [];
+
         if ($container->hasParameter($this->eventAliasesParameter)) {
             $aliases = $container->getParameter($this->eventAliasesParameter);
-            $container->getParameterBag()->remove($this->eventAliasesParameter);
-        } else {
-            $aliases = [];
         }
+
         $globalDispatcherDefinition = $container->findDefinition($this->dispatcherService);
 
         foreach ($container->findTaggedServiceIds($this->listenerTag, true) as $id => $events) {
diff --git a/src/Symfony/Component/EventDispatcher/Tests/DependencyInjection/RegisterListenersPassTest.php b/src/Symfony/Component/EventDispatcher/Tests/DependencyInjection/RegisterListenersPassTest.php
@@ -234,17 +234,22 @@ public function testInvokableEventListener()
     public function testAliasedEventListener(): void
     {
         $container = new ContainerBuilder();
-        $container->setParameter('event_dispatcher.event_aliases', [AliasedEvent::class => 'aliased_event']);
+        $eventAliases = [AliasedEvent::class => 'aliased_event'];
+        $container->setParameter('event_dispatcher.event_aliases', $eventAliases);
         $container->register('foo', InvokableListenerService::class)->addTag('kernel.event_listener', ['event' => AliasedEvent::class, 'method' => 'onEvent']);
         $container->register('bar', InvokableListenerService::class)->addTag('kernel.event_listener', ['event' => CustomEvent::class, 'method' => 'onEvent']);
         $container->register('event_dispatcher');
 
-        $eventAliasPass = new AddEventAliasesPass([CustomEvent::class => 'custom_event']);
+        $customEventAlias = [CustomEvent::class => 'custom_event'];
+        $eventAliasPass = new AddEventAliasesPass($customEventAlias);
         $eventAliasPass->process($container);
 
         $registerListenersPass = new RegisterListenersPass();
         $registerListenersPass->process($container);
 
+        $this->assertTrue($container->hasParameter('event_dispatcher.event_aliases'));
+        $this->assertSame(array_merge($eventAliases, $customEventAlias), $container->getParameter('event_dispatcher.event_aliases'));
+
         $definition = $container->getDefinition('event_dispatcher');
         $expectedCalls = [
             [
diff --git a/src/Symfony/Component/HttpClient/Response/CurlResponse.php b/src/Symfony/Component/HttpClient/Response/CurlResponse.php
@@ -312,8 +312,15 @@ private static function parseHeaderLine($ch, string $data, array &$info, array &
         }
 
         if ("\r\n" !== $data) {
-            // Regular header line: add it to the list
-            self::addResponseHeaders([substr($data, 0, -2)], $info, $headers);
+            try {
+                // Regular header line: add it to the list
+                self::addResponseHeaders([substr($data, 0, -2)], $info, $headers);
+            } catch (TransportException $e) {
+                $multi->handlesActivity[$id][] = null;
+                $multi->handlesActivity[$id][] = $e;
+
+                return \strlen($data);
+            }
 
             if (0 !== strpos($data, 'HTTP/')) {
                 if (0 === stripos($data, 'Location:')) {
diff --git a/src/Symfony/Component/HttpClient/Response/ResponseTrait.php b/src/Symfony/Component/HttpClient/Response/ResponseTrait.php
@@ -253,7 +253,7 @@ private static function initialize(self $response): void
     private static function addResponseHeaders(array $responseHeaders, array &$info, array &$headers, string &$debug = ''): void
     {
         foreach ($responseHeaders as $h) {
-            if (11 <= \strlen($h) && '/' === $h[4] && preg_match('#^HTTP/\d+(?:\.\d+)? ([12345]\d\d)(?: |$)#', $h, $m)) {
+            if (11 <= \strlen($h) && '/' === $h[4] && preg_match('#^HTTP/\d+(?:\.\d+)? ([1-9]\d\d)(?: |$)#', $h, $m)) {
                 if ($headers) {
                     $debug .= "< \r\n";
                     $headers = [];
diff --git a/src/Symfony/Component/HttpKernel/EventListener/ProfilerListener.php b/src/Symfony/Component/HttpKernel/EventListener/ProfilerListener.php
@@ -119,7 +119,7 @@ public function onKernelTerminate(TerminateEvent $event)
     public static function getSubscribedEvents(): array
     {
         return [
-            KernelEvents::RESPONSE => ['onKernelResponse', -100],
+            KernelEvents::RESPONSE => ['onKernelResponse', -1012],
             KernelEvents::EXCEPTION => ['onKernelException', 0],
             KernelEvents::TERMINATE => ['onKernelTerminate', -1024],
         ];
diff --git a/src/Symfony/Component/Messenger/Command/SetupTransportsCommand.php b/src/Symfony/Component/Messenger/Command/SetupTransportsCommand.php
@@ -41,6 +41,7 @@ protected function configure()
     {
         $this
             ->addArgument('transport', InputArgument::OPTIONAL, 'Name of the transport to setup', null)
+            ->setDescription('Prepares the required infrastructure for the transport')
             ->setHelp(<<<EOF
 The <info>%command.name%</info> command setups the transports:
 
diff --git a/src/Symfony/Component/Security/Core/Encoder/NativePasswordEncoder.php b/src/Symfony/Component/Security/Core/Encoder/NativePasswordEncoder.php
@@ -24,7 +24,7 @@ final class NativePasswordEncoder implements PasswordEncoderInterface, SelfSalti
 {
     private const MAX_PASSWORD_LENGTH = 4096;
 
-    private $algo;
+    private $algo = PASSWORD_BCRYPT;
     private $options;
 
     /**
@@ -48,7 +48,20 @@ public function __construct(int $opsLimit = null, int $memLimit = null, int $cos
             throw new \InvalidArgumentException('$cost must be in the range of 4-31.');
         }
 
-        $this->algo = (string) ($algo ?? (\defined('PASSWORD_ARGON2ID') ? PASSWORD_ARGON2ID : (\defined('PASSWORD_ARGON2I') ? PASSWORD_ARGON2I : PASSWORD_BCRYPT)));
+        $algos = [1 => PASSWORD_BCRYPT, '2y' => PASSWORD_BCRYPT];
+
+        if (\defined('PASSWORD_ARGON2I')) {
+            $this->algo = $algos[2] = $algos['argon2i'] = (string) PASSWORD_ARGON2I;
+        }
+
+        if (\defined('PASSWORD_ARGON2ID')) {
+            $this->algo = $algos[3] = $algos['argon2id'] = (string) PASSWORD_ARGON2ID;
+        }
+
+        if (null !== $algo) {
+            $this->algo = $algos[$algo] ?? $algo;
+        }
+
         $this->options = [
             'cost' => $cost,
             'time_cost' => $opsLimit,
diff --git a/src/Symfony/Component/Security/Core/Tests/Authentication/AuthenticationProviderManagerTest.php b/src/Symfony/Component/Security/Core/Tests/Authentication/AuthenticationProviderManagerTest.php
@@ -54,10 +54,16 @@ public function testAuthenticateWhenNoProviderSupportsToken()
 
     public function testAuthenticateWhenProviderReturnsAccountStatusException()
     {
+        $secondAuthenticationProvider = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Provider\AuthenticationProviderInterface')->getMock();
+
         $manager = new AuthenticationProviderManager([
             $this->getAuthenticationProvider(true, null, 'Symfony\Component\Security\Core\Exception\AccountStatusException'),
+            $secondAuthenticationProvider,
         ]);
 
+        // AccountStatusException stops authentication
+        $secondAuthenticationProvider->expects($this->never())->method('supports');
+
         try {
             $manager->authenticate($token = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock());
             $this->fail();
diff --git a/src/Symfony/Component/Security/Core/Tests/Encoder/NativePasswordEncoderTest.php b/src/Symfony/Component/Security/Core/Tests/Encoder/NativePasswordEncoderTest.php
@@ -73,6 +73,14 @@ public function testConfiguredAlgorithm()
         $this->assertStringStartsWith('$2', $result);
     }
 
+    public function testConfiguredAlgorithmWithLegacyConstValue()
+    {
+        $encoder = new NativePasswordEncoder(null, null, null, '1');
+        $result = $encoder->encodePassword('password', null);
+        $this->assertTrue($encoder->isPasswordValid($result, 'password', null));
+        $this->assertStringStartsWith('$2', $result);
+    }
+
     public function testCheckPasswordLength()
     {
         $encoder = new NativePasswordEncoder(null, null, 4);
diff --git a/src/Symfony/Component/Serializer/Normalizer/AbstractNormalizer.php b/src/Symfony/Component/Serializer/Normalizer/AbstractNormalizer.php
@@ -411,20 +411,30 @@ protected function instantiateObject(array &$data, string $class, array &$contex
     protected function denormalizeParameter(\ReflectionClass $class, \ReflectionParameter $parameter, string $parameterName, $parameterData, array $context, string $format = null)
     {
         try {
-            if (null !== $parameter->getClass()) {
+            if (\PHP_VERSION_ID < 70100 && null !== $parameterClass = $parameter->getClass()) {
+                $parameterClass = $parameterClass->name;
+            } elseif (\PHP_VERSION_ID >= 70100 && $parameter->hasType() && ($parameterType = $parameter->getType()) && !$parameterType->isBuiltin()) {
+                $parameterClass = $parameterType->getName();
+                new \ReflectionClass($parameterClass); // throws a \ReflectionException if the class doesn't exist
+            } else {
+                $parameterClass = null;
+            }
+
+            if (null !== $parameterClass) {
                 if (!$this->serializer instanceof DenormalizerInterface) {
-                    throw new LogicException(sprintf('Cannot create an instance of "%s" from serialized data because the serializer inject in "%s" is not a denormalizer.', $parameter->getClass(), self::class));
+                    throw new LogicException(sprintf('Cannot create an instance of "%s" from serialized data because the serializer inject in "%s" is not a denormalizer.', $parameterClass, static::class));
                 }
-                $parameterClass = $parameter->getClass()->getName();
-                $parameterData = $this->serializer->denormalize($parameterData, $parameterClass, $format, $this->createChildContext($context, $parameterName, $format));
+
+                return $this->serializer->denormalize($parameterData, $parameterClass, $format, $this->createChildContext($context, $parameterName, $format));
             }
         } catch (\ReflectionException $e) {
             throw new RuntimeException(sprintf('Could not determine the class of the parameter "%s".', $parameterName), 0, $e);
         } catch (MissingConstructorArgumentsException $e) {
             if (!$parameter->getType()->allowsNull()) {
                 throw $e;
             }
-            $parameterData = null;
+
+            return null;
         }
 
         return $parameterData;
diff --git a/src/Symfony/Component/Translation/Tests/TranslatorTest.php b/src/Symfony/Component/Translation/Tests/TranslatorTest.php
@@ -12,6 +12,7 @@
 namespace Symfony\Component\Translation\Tests;
 
 use PHPUnit\Framework\TestCase;
+use Symfony\Component\Translation\Exception\RuntimeException;
 use Symfony\Component\Translation\Loader\ArrayLoader;
 use Symfony\Component\Translation\MessageCatalogue;
 use Symfony\Component\Translation\Translator;
@@ -513,6 +514,16 @@ public function testIntlFormattedDomain()
         $translator->addResource('array', ['some_message' => 'Hi {name}'], 'en', 'messages+intl-icu');
         $this->assertSame('Hi Bob', $translator->trans('some_message', ['%name%' => 'Bob']));
     }
+
+    public function testMissingLoaderForResourceError()
+    {
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('No loader is registered for the "twig" format when loading the "messages.en.twig" resource.');
+
+        $translator = new Translator('en');
+        $translator->addResource('twig', 'messages.en.twig', 'en');
+        $translator->getCatalogue('en');
+    }
 }
 
 class StringClass
diff --git a/src/Symfony/Component/Translation/Translator.php b/src/Symfony/Component/Translation/Translator.php
@@ -365,7 +365,11 @@ protected function doLoadCatalogue(string $locale): void
         if (isset($this->resources[$locale])) {
             foreach ($this->resources[$locale] as $resource) {
                 if (!isset($this->loaders[$resource[0]])) {
-                    throw new RuntimeException(sprintf('The "%s" translation loader is not registered.', $resource[0]));
+                    if (\is_string($resource[1])) {
+                        throw new RuntimeException(sprintf('No loader is registered for the "%s" format when loading the "%s" resource.', $resource[0], $resource[1]));
+                    }
+
+                    throw new RuntimeException(sprintf('No loader is registered for the "%s" format.', $resource[0]));
                 }
                 $this->catalogues[$locale]->addCatalogue($this->loaders[$resource[0]]->load($resource[1], $locale, $resource[2]));
             }
diff --git a/src/Symfony/Component/VarDumper/Caster/SplCaster.php b/src/Symfony/Component/VarDumper/Caster/SplCaster.php
@@ -91,6 +91,8 @@ public static function castFileInfo(\SplFileInfo $c, array $a, Stub $stub, bool
         ];
 
         $prefix = Caster::PREFIX_VIRTUAL;
+        unset($a["\0SplFileInfo\0fileName"]);
+        unset($a["\0SplFileInfo\0pathName"]);
 
         if (false === $c->getPathname()) {
             $a[$prefix.'⚠'] = 'The parent constructor was not called: the object is in an invalid state';
diff --git a/src/Symfony/Component/Yaml/Parser.php b/src/Symfony/Component/Yaml/Parser.php
@@ -764,7 +764,8 @@ private function parseValue(string $value, int $flags, string $context)
                 $lines[] = trim($this->currentLine);
 
                 // quoted string values end with a line that is terminated with the quotation character
-                if ('' !== $this->currentLine && $this->currentLine[-1] === $quotation) {
+                $escapedLine = str_replace(['\\\\', '\\"'], '', $this->currentLine);
+                if ('' !== $escapedLine && $escapedLine[-1] === $quotation) {
                     break;
                 }
             }
diff --git a/src/Symfony/Component/Yaml/Tests/ParserTest.php b/src/Symfony/Component/Yaml/Tests/ParserTest.php
@@ -1529,6 +1529,33 @@ public function testBlankLinesInQuotedMultiLineString()
         $this->assertSame($expected, $this->parser->parse($yaml));
     }
 
+    public function testEscapedQuoteInQuotedMultiLineString()
+    {
+        $yaml = <<<YAML
+foobar: "foo
+    \\"bar\\"
+    baz"
+YAML;
+        $expected = [
+            'foobar' => 'foo "bar" baz',
+        ];
+
+        $this->assertSame($expected, $this->parser->parse($yaml));
+    }
+
+    public function testBackslashInQuotedMultiLineString()
+    {
+        $yaml = <<<YAML
+foobar: "foo
+    bar\\\\"
+YAML;
+        $expected = [
+            'foobar' => 'foo bar\\',
+        ];
+
+        $this->assertSame($expected, $this->parser->parse($yaml));
+    }
+
     public function testParseMultiLineUnquotedString()
     {
         $yaml = <<<EOT

Original file line number	Diff line number	Diff line change
`@@ -133,6 +133,12 @@ private function updateCspHeaders(Response $response, array $nonces = []): array`
`133`	`133`	`continue;`
`134`	`134`	`}`
`135`	`135`
	`136`	`+ if (['\'none\''] === $fallback) {`
	`137`	`+ // Fallback came from "default-src: 'none'"`
	`138`	`+ // 'none' is invalid if it's not the only expression in the source list, so we leave it out`
	`139`	`+ $fallback = [];`
	`140`	`+ }`
	`141`	`+`
`136`	`142`	`$headers[$header][$type] = $fallback;`
`137`	`143`	`}`
`138`	`144`	`$ruleIsSet = true;`
Original file line number	Diff line number	Diff line change
`@@ -71,12 +71,12 @@ public function process(ContainerBuilder $container)`
`71`	`71`	`return;`
`72`	`72`	`}`
`73`	`73`
	`74`	`+ $aliases = [];`
	`75`	`+`
`74`	`76`	`if ($container->hasParameter($this->eventAliasesParameter)) {`
`75`	`77`	`$aliases = $container->getParameter($this->eventAliasesParameter);`
`76`		`- $container->getParameterBag()->remove($this->eventAliasesParameter);`
`77`		`- } else {`
`78`		`- $aliases = [];`
`79`	`78`	`}`
	`79`	`+`
`80`	`80`	`$globalDispatcherDefinition = $container->findDefinition($this->dispatcherService);`
`81`	`81`
`82`	`82`	`foreach ($container->findTaggedServiceIds($this->listenerTag, true) as $id => $events) {`
Original file line number	Diff line number	Diff line change
`@@ -253,7 +253,7 @@ private static function initialize(self $response): void`
`253`	`253`	`private static function addResponseHeaders(array $responseHeaders, array &$info, array &$headers, string &$debug = ''): void`
`254`	`254`	`{`
`255`	`255`	`foreach ($responseHeaders as $h) {`
`256`		`- if (11 <= \strlen($h) && '/' === $h[4] && preg_match('#^HTTP/\d+(?:\.\d+)? ([12345]\d\d)(?: \|$)#', $h, $m)) {`
	`256`	`+ if (11 <= \strlen($h) && '/' === $h[4] && preg_match('#^HTTP/\d+(?:\.\d+)? ([1-9]\d\d)(?: \|$)#', $h, $m)) {`
`257`	`257`	`if ($headers) {`
`258`	`258`	`$debug .= "< \r\n";`
`259`	`259`	`$headers = [];`
Original file line number	Diff line number	Diff line change
`@@ -119,7 +119,7 @@ public function onKernelTerminate(TerminateEvent $event)`
`119`	`119`	`public static function getSubscribedEvents(): array`
`120`	`120`	`{`
`121`	`121`	`return [`
`122`		`- KernelEvents::RESPONSE => ['onKernelResponse', -100],`
	`122`	`+ KernelEvents::RESPONSE => ['onKernelResponse', -1012],`
`123`	`123`	`KernelEvents::EXCEPTION => ['onKernelException', 0],`
`124`	`124`	`KernelEvents::TERMINATE => ['onKernelTerminate', -1024],`
`125`	`125`	`];`
Original file line number	Diff line number	Diff line change
`@@ -41,6 +41,7 @@ protected function configure()`
`41`	`41`	`{`
`42`	`42`	`$this`
`43`	`43`	`->addArgument('transport', InputArgument::OPTIONAL, 'Name of the transport to setup', null)`
	`44`	`+ ->setDescription('Prepares the required infrastructure for the transport')`
`44`	`45`	`->setHelp(<<<EOF`
`45`	`46`	`The <info>%command.name%</info> command setups the transports:`
`46`	`47`