Skip to content

[Security] Cannot use env in RememberMe config #36271

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
zek opened this issue Mar 30, 2020 · 15 comments
Closed

[Security] Cannot use env in RememberMe config #36271

zek opened this issue Mar 30, 2020 · 15 comments

Comments

@zek
Copy link
Contributor

zek commented Mar 30, 2020

Symfony version(s) affected: 3.4.39

Description
This is working until today's 3.4.39 update. using env in security.yaml causes this error.

Invalid type for path "security.firewalls.main.remember_me.lifetime". Expected int, but got string.

How to reproduce
inside of security.yaml

lifetime: '%env(int:REMEMBER_ME_COOKIE_LIFETIME)%'

Possible Solution
Remove these lines
https://github.com/symfony/symfony/pull/35910/files#diff-63961cbd5c56cdeb2e94e6024d58327fR148-R149

Additional context
image

@zek zek added the Bug label Mar 30, 2020
@zek zek changed the title [Security] Cannot use integer env in RememberMe config [Security] Cannot use env in RememberMe config Mar 30, 2020
@nicolas-grekas
Copy link
Member

Which version were you upgrading from? Can you provide a small reproducing app that worked before and doesn't anymore please? That'd help ppl that want to debug this (could be you btw, up to?)

@zek
Copy link
Contributor Author

zek commented Apr 1, 2020

Which version were you upgrading from?

I was upgrading from 3.4.38.

Can you provide a small reproducing app that worked before and doesn't anymore please?

OK I can try.

@zek
Copy link
Contributor Author

zek commented Apr 1, 2020

Here is the repo https://github.com/zek/symfony-bug

I didn't complete rest of the reproduction.
I've just added the configuration which causes error.

image

@zek
Copy link
Contributor Author

zek commented Apr 1, 2020

What I'm trying to do is
use env variables in security.yaml remember_me config. So there is no special config actually.

image

@wouterj
Copy link
Member

wouterj commented Apr 2, 2020

Hmm, so I'm guessing this is what happends:

  • lifetime is now an integerNode()
  • For the Config component (which IIRC doesn't know anything about env variables), you're passing a string: "%env(int:REMEMBER_ME_COOKIE_LIFETIME)%"
  • This throws an error, although if it wouldn't, the DI component would sucessfully process the string into a integer before it's used by any PHP class.

So we either make Config aware of environment variables (that's probably a huge feature) or we revert the integerNode() changes (as you suggested).

@HeahDude am I mislooking something, or would reverting these 2 lines not result in much harm? (only a little less strict config processor)

@HeahDude
Copy link
Contributor

HeahDude commented Apr 3, 2020

Yes we should revert.

Also as @wouterj explained the Config component does not know about env processors...

It means that any node, excepted for ScalarNode, has potentially an issue with env variables which will be always read as strings by the loaders, an array could be %env(json:file:...)% etc.
Sounds very complex to try to handle this from any component, and probably too much to allow strings on every nodes...

@wouterj
Copy link
Member

wouterj commented Apr 3, 2020

@zek as you were the one reporting and discovering the lines that broke this, are you maybe up for a PR to revert the change on the 3.4 branch? That would give you all credits you deserve :)


It means that any node, excepted for ScalarNode, has potentially an issue with env variables which will be always read as strings by the loaders, an array could be %env(json:file:...)% etc.
Sounds very complex to try to handle this from any component, and probably too much to allow strings on every nodes...

Yes, this is also what I was thinking about. I think it might be possible to "solve" it a little bit if Config would recognize that it is an env string and discover the env processor. There are env processors for each type. E.g. if something is %env(int:...)%, we can be sure it'll be an integer when it is processed by DI.

This would make the Config component aware of the fullstack framework though. I'm not sure how to fix that, but this could be a way of solving it for all config nodes.

@nicolas-grekas
Copy link
Member

4.4 is already able to know about these, but not 3.4 indeed.

@wouterj
Copy link
Member

wouterj commented Apr 3, 2020

Oh, so in that case, the revert should only happen in 3.4?

@nicolas-grekas
Copy link
Member

I suppose yes, can anyone confirm on 4.4?

@wouterj
Copy link
Member

wouterj commented Apr 3, 2020

I can confirm that I no longer have this error when I update the reproducer to Symfony 4.4 (thanks for providing a reproducer, that makes it very easy to confirm/test!)

@zek
Copy link
Contributor Author

zek commented Apr 3, 2020

@zek as you were the one reporting and discovering the lines that broke this, are you maybe up for a PR to revert the change on the 3.4 branch? That would give you all credits you deserve :)

Ok. I'll send a PR today. Thank you all @wouterj @HeahDude @nicolas-grekas 👍

@nicolas-grekas
Copy link
Member

friendly ping @zek

nicolas-grekas added a commit that referenced this issue Apr 18, 2020
…figurations (zek)

This PR was merged into the 3.4 branch.

Discussion
----------

[SecurityBundle] fix accepting env vars in remember-me configurations

| Q             | A
| ------------- | ---
| Branch?       | 3.4
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | Fix #36271
| License       | MIT
| Doc PR        | -

As @wouterj explained we cannot use env variables after #35910 merged.

> Hmm, so I'm guessing this is what happens:
>
> * `lifetime` is now an `integerNode()`
> * For the Config component (which IIRC doesn't know anything about env variables), you're passing a string: `"%env(int:REMEMBER_ME_COOKIE_LIFETIME)%"`
> * This throws an error, although if it wouldn't, the DI component would sucessfully process the string into a integer before it's used by any PHP class.
>
> So we either make Config aware of environment variables (that's probably a huge feature) or we revert the `integerNode()` changes (as you suggested).
>
> @HeahDude am I mislooking something, or would reverting these 2 lines not result in much harm? (only a little less strict config processor)

Commits
-------

46c2783 [SecurityBundle] fix accepting env vars in remember-me configurations
@escopecz
Copy link

I can see this was fixed for 3.4, but it exists on 4.4+. How come it's not a problem on newer versions? Because we have exactly the same problem on Symfony 4.4 (mautic/mautic#9011)

@nicolas-grekas
Copy link
Member

Please don't comment on closed issues/PRs, you might get no follow up.
Open an issue instead, or a PR maybe?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

7 participants