Skip to content

Expression engine doesn't handle expressions inside parameters #9658

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mvrhov opened this issue Nov 29, 2013 · 16 comments
Closed

Expression engine doesn't handle expressions inside parameters #9658

mvrhov opened this issue Nov 29, 2013 · 16 comments
Labels
ExpressionLanguage Good first issue Ideal for your first contribution! (some Symfony experience may be required)

Comments

@mvrhov
Copy link

mvrhov commented Nov 29, 2013

I'm getting _Call to undefined method Symfony\Component\ExpressionLanguage\Expression::_set_state() ..... in /app/var/cache/dev/appDevDebugProjectContainer.php line 8170

When I set up the parameter like:

parameters:
    session_save_path: "@=service('opensky.runtime_config').get('app.session_save_path')"

The line 8170 has the following code.

    protected function getDefaultParameters()
    {
        return array(
....
'session_save_path' => Symfony\Component\ExpressionLanguage\Expression::__set_state(array(
   'expression' => 'service(\'opensky.runtime_config\').get(\'app.session_save_path\')',
)),
....

The service that receives that specific parameter works just fine.

@fabpot
Copy link
Member

fabpot commented Nov 30, 2013

Indeed, that's not supported. Parameters are static and should not be expressions. I will see how to raise an exception in this case.

@mvrhov
Copy link
Author

mvrhov commented Nov 30, 2013

Please don't. I really need this feature in a multitenant application. Having an app for each tenant uses way to many memory.
edit: maybe a closure could be dumped into the array if it cannot be solved otherwise.
Or such parameters should be dumped into another function e.g. getExpressionParameter

@mvrhov
Copy link
Author

mvrhov commented Dec 6, 2013

Ah the case with session works partially because that specific session is defined as a service in config.yml.
So It seems that this doesn't work at all.
Which is the shame. It would be really nice if some settings inside config.* files could be dynamic e.g configured with Expression engine.

@michelsalib
Copy link

Can't your issue be solved by overriding the session service ?

@adrienbrault
Copy link
Contributor

What about allowing expressions but without access to the container ? Only parameters

@fabpot
Copy link
Member

fabpot commented Dec 9, 2013

@adrienbrault I don't think this is worth it as you can already use parameter values in a parameter: foo %foo%

@mvrhov
Copy link
Author

mvrhov commented Dec 9, 2013

@michelsalib: The session is just one service that needs to be configured on the fly. There are others. e.g framework seecret, remember me key,...

@michelsalib
Copy link

How about several prod_env switched in app.php by reading the Server variable ?

Quick, maybe dirty but afterall that's what you want.

Michel Salib


De : Miha Vrhovnikmailto:notifications@github.com
Envoyé : ‎09/‎12/‎2013 09:17
À : symfony/symfonymailto:symfony@noreply.github.com
Cc : Michel Salibmailto:michelsalib@hotmail.com
Objet : Re: [symfony] Expression engine doesn't handle expressions inside parameters (#9658)

@michelsalib: The session is just one service that needs to be configured on the fly. There are others.


Reply to this email directly or view it on GitHub:
#9658 (comment)

@mvrhov
Copy link
Author

mvrhov commented Dec 9, 2013

Having an app per tenant doesn't scale. Just run an app with enabled ZendOptimizer and look at the memory consumed by files in app. The other thing is. upgrading application in such a scenario would be a nightmare

fabpot added a commit that referenced this issue Dec 12, 2013
…n expressions (aitboudad)

This PR was merged into the 2.4 branch.

Discussion
----------

[ExpressionLanguage] throw exception when parameters contain expressions

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #9658
| License       | MIT
| Doc PR        | symfony/symfony-docs#3232

Commits
-------

ca123bc [ExpressionLanguage] throw exception when parameters contain expressions
@fabpot fabpot closed this as completed Dec 12, 2013
@broncha
Copy link

broncha commented Dec 30, 2015

I know this is an old thread. But recently I had to define redundant parameters. I had to define the locale for routes, and the same locales but as an array for a different parameter. e.g

parameters:
    locale: en|np
    supported_locales: [en, np]

The locale parameter is for the framework config, and supported_locales for a custom bundle.

This is a whitelabel product I am working on, so these values will be different for different installations.
And adding a new locale requires editing 2 values, which sometimes people forget. It would be really great if we could do something like

parameters:
    locale: en|np
    supported_locales: (%locale%).split("|")  #don't mind the syntax, you get what I am trying to say here

@stof
Copy link
Member

stof commented Dec 30, 2015

@broncha what you could do is having a single parameter defined in the parameters.yml file, and having the DI extension of a bundle set the other one based on the first one.

@broncha
Copy link

broncha commented Dec 30, 2015

@stof yes I could do that. I just mentioned it as an example, and there could be many other cases. That would be a kind of syntatic sugar.

@b7kich
Copy link

b7kich commented Jan 9, 2017

@michelsalib @fabpot Can you fix this?

Environment variables are key for deployment configuration in modern applications (12factor.net). But dumping sensitive information like database passwords, API keys and other access credentials to disk is a security risk in multi-tenant environments. In addition to exposing access credentials in a known location the dumped container can be overwritten with malicious code by anyone using the webserver without even escalating privileges in most cases.

It is also a scalability issue. Networked filesystems (NFS, AFS, etc) generally are notoriously bad at negotiating write locks and local storage means a waste of resources if each machine compiles the container for itself.

At least there should be a check or path postfix indicating whether the environment variables have changed to avoid running with stale configs.

@stof
Copy link
Member

stof commented Jan 9, 2017

@b7kich do you actually have a use case for defining parameters dynamically based on credentials ? This is what this issue is about.

If you just want to configure services based on env variables, this is possible in Symfony 3.2 already.

anyway, commenting on an issue closed 1 year ago is probably not the best place to discuss your own issue.

@b7kich
Copy link

b7kich commented Jan 9, 2017

Hi @stof - sorry if I wasn't clear enough or got off on a tangent. I'll check out the 3.2 branch.

I use an expression extension to dynamically configure sensitive parameters from environment variables but it could be anything else. I do use the SYMFONY__ env prefix and %% for regular parameters and the expression extension works fine for all my services. Where it doesn't is e.g. the doctrine dbal connection credentials or framework.secret.

@b7kich
Copy link

b7kich commented Jan 9, 2017

beautiful - env injection works perfectly in 3.2. Thanks for the hint!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ExpressionLanguage Good first issue Ideal for your first contribution! (some Symfony experience may be required)
Projects
None yet
Development

No branches or pull requests

7 participants