bug #30749 [Serializer] Added check of constuctor modifiers to AbstractNormalizer (NekaKawaii)

fabpot · fabpot · commit cc6bfea220ae · 2019-03-30T08:26:43.000+01:00
This PR was submitted for the 4.2 branch but it was merged into the 3.4 branch instead (closes #30749). Discussion ---------- [Serializer] Added check of constuctor modifiers to AbstractNormalizer | Q | A | ------------- | --- | Branch? | 4.2 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #30748 | License | MIT If constructor is not public, instantiate target object without constructor to prevent errors like `Access to non-public constructor of class Target` Commits ------- eb0e14c [Serializer] Added check of constuctor modifiers to AbstractNormalizer
diff --git a/src/Symfony/Component/Serializer/Normalizer/AbstractNormalizer.php b/src/Symfony/Component/Serializer/Normalizer/AbstractNormalizer.php
@@ -333,6 +333,10 @@ protected function instantiateObject(array &$data, $class, array &$context, \Ref
 
         $constructor = $this->getConstructor($data, $class, $context, $reflectionClass, $allowedAttributes);
         if ($constructor) {
+            if (true !== $constructor->isPublic()) {
+                return $reflectionClass->newInstanceWithoutConstructor();
+            }
+
             $constructorParameters = $constructor->getParameters();
 
             $params = [];
