Merge branch '3.4'

* 3.4: (26 commits)
  [Bridge\PhpUnit] Disable broken auto-require mechanism of phpunit
  [Console] Fix disabling lazy commands
  [DI] Remove scalar typehint in class used in test case
  Remove the `server:log` command if monolog is not loaded
  [SecurityBundle] Fix syntax error in test
  [Console] Remove remaining dead code
  Throw on service:method factory notation in PHP-based DI configuration
  Test that named arguments are prioritized over typehinted
  bumped Symfony version to 3.3.14
  bumped Symfony version to 2.8.32
  bumped Symfony version to 2.7.39
  Prove that change is working with tests
  updated VERSION for 3.3.13
  updated CHANGELOG for 3.3.13
  updated VERSION for 2.8.31
  updated CHANGELOG for 2.8.31
  updated VERSION for 2.7.38
  updated CHANGELOG for 2.7.38
  Replace array|\Traversable by iterable
  [DI] Fix by-type args injection
  ...

Author: nicolas-grekas

CHANGELOG-3.3.md

@@ -7,6 +7,13 @@ in 3.3 minor versions.
 To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash
 To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v3.3.0...v3.3.1
 
+* 3.3.13 (2017-11-16)
+
+ * security #24995 Validate redirect targets using the session cookie domain (nicolas-grekas)
+ * security #24994 Prevent bundle readers from breaking out of paths (xabbuh)
+ * security #24993 Ensure that submitted data are uploaded files (xabbuh)
+ * security #24992 Namespace generated CSRF tokens depending of the current scheme (dunglas)
+
 * 3.3.12 (2017-11-13)
 
  * bug #24954 [DI] Fix dumping with custom base class (nicolas-grekas)

src/Symfony/Bridge/PhpUnit/Blacklist.php

@@ -0,0 +1,41 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <[email protected]>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Bridge\PhpUnit;
+
+/**
+ * Utility class replacing PHPUnit's implementation of the same class.
+ *
+ * All files are blacklisted so that process-isolated tests don't start with broken
+ * "require_once" statements. Composer is the only supported way to load code there.
+ */
+class Blacklist
+{
+    public static $blacklistedClassNames = array();
+
+    public function getBlacklistedDirectories()
+    {
+        $root = dirname(__DIR__);
+        while ($root !== $parent = dirname($root)) {
+            $root = $parent;
+        }
+
+        return array($root);
+    }
+
+    public function isBlacklisted($file)
+    {
+        return true;
+    }
+}
+
+class_alias('Symfony\Bridge\PhpUnit\Blacklist', 'PHPUnit\Util\Blacklist');
+class_alias('Symfony\Bridge\PhpUnit\Blacklist', 'PHPUnit_Util_Blacklist');

src/Symfony/Bridge/PhpUnit/Legacy/SymfonyTestsListenerTrait.php

@@ -15,7 +15,6 @@
 use PHPUnit\Framework\AssertionFailedError;
 use PHPUnit\Framework\TestCase;
 use PHPUnit\Framework\TestSuite;
-use PHPUnit\Util\Blacklist;
 use Symfony\Bridge\PhpUnit\ClockMock;
 use Symfony\Bridge\PhpUnit\DnsMock;
 
@@ -46,17 +45,6 @@ class SymfonyTestsListenerTrait
      */
     public function __construct(array $mockedNamespaces = array())
     {
-        if (class_exists('PHPUnit_Util_Blacklist')) {
-            \PHPUnit_Util_Blacklist::$blacklistedClassNames['\Symfony\Bridge\PhpUnit\DeprecationErrorHandler'] = 1;
-            \PHPUnit_Util_Blacklist::$blacklistedClassNames['\Symfony\Bridge\PhpUnit\SymfonyTestsListener'] = 1;
-            \PHPUnit_Util_Blacklist::$blacklistedClassNames['\Symfony\Bridge\PhpUnit\Legacy\SymfonyTestsListener'] = 1;
-            \PHPUnit_Util_Blacklist::$blacklistedClassNames['\Symfony\Bridge\PhpUnit\Legacy\SymfonyTestsListenerTrait'] = 1;
-        } else {
-            Blacklist::$blacklistedClassNames['\Symfony\Bridge\PhpUnit\DeprecationErrorHandler'] = 1;
-            Blacklist::$blacklistedClassNames['\Symfony\Bridge\PhpUnit\SymfonyTestsListener'] = 1;
-            Blacklist::$blacklistedClassNames['\Symfony\Bridge\PhpUnit\Legacy\SymfonyTestsListenerTrait'] = 1;
-        }
-
         foreach ($mockedNamespaces as $type => $namespaces) {
             if (!is_array($namespaces)) {
                 $namespaces = array($namespaces);
@@ -94,7 +82,7 @@ public function globalListenerDisabled()
 
     public function startTestSuite($suite)
     {
-        if (class_exists('PHPUnit_Util_Blacklist', false)) {
+        if (class_exists('PHPUnit_Util_Test', false)) {
             $Test = 'PHPUnit_Util_Test';
         } else {
             $Test = 'PHPUnit\Util\Test';
@@ -181,7 +169,7 @@ public function startTest($test)
                 putenv('SYMFONY_DEPRECATIONS_SERIALIZE='.$this->runsInSeparateProcess);
             }
 
-            if (class_exists('PHPUnit_Util_Blacklist', false)) {
+            if (class_exists('PHPUnit_Util_Test', false)) {
                 $Test = 'PHPUnit_Util_Test';
                 $AssertionFailedError = 'PHPUnit_Framework_AssertionFailedError';
             } else {
@@ -227,7 +215,7 @@ public function addWarning($test, $e, $time)
 
     public function endTest($test, $time)
     {
-        if (class_exists('PHPUnit_Util_Blacklist', false)) {
+        if (class_exists('PHPUnit_Util_Test', false)) {
             $Test = 'PHPUnit_Util_Test';
             $BaseTestRunner = 'PHPUnit_Runner_BaseTestRunner';
             $Warning = 'PHPUnit_Framework_Warning';

src/Symfony/Bridge/PhpUnit/bin/simple-phpunit

@@ -82,17 +82,6 @@ if (!file_exists("$PHPUNIT_DIR/phpunit-$PHPUNIT_VERSION/phpunit") || md5_file(__
 define('PHPUNIT_COMPOSER_INSTALL', __DIR__.'/vendor/autoload.php');
 require PHPUNIT_COMPOSER_INSTALL;
 
-if (!class_exists('SymfonyBlacklistPhpunit', false)) {
-    class SymfonyBlacklistPhpunit {}
-}
-if (class_exists('PHPUnit_Util_Blacklist')) {
-    PHPUnit_Util_Blacklist::$blacklistedClassNames['SymfonyBlacklistPhpunit'] = 1;
-    PHPUnit_Util_Blacklist::$blacklistedClassNames['SymfonyBlacklistSimplePhpunit'] = 1;
-} else {
-    PHPUnit\Util\Blacklist::$blacklistedClassNames['SymfonyBlacklistPhpunit'] = 1;
-    PHPUnit\Util\Blacklist::$blacklistedClassNames['SymfonyBlacklistSimplePhpunit'] = 1;
-}
-
 Symfony\Bridge\PhpUnit\TextUI\Command::main();
 
 EOPHP
@@ -211,9 +200,6 @@ if ($components) {
         }
     }
 } elseif (!isset($argv[1]) || 'install' !== $argv[1] || file_exists('install')) {
-    if (!class_exists('SymfonyBlacklistSimplePhpunit', false)) {
-        class SymfonyBlacklistSimplePhpunit {}
-    }
     array_splice($argv, 1, 0, array('--colors=always'));
     $_SERVER['argv'] = $argv;
     $_SERVER['argc'] = ++$argc;

src/Symfony/Bridge/PhpUnit/bootstrap.php

@@ -12,6 +12,9 @@
 use Doctrine\Common\Annotations\AnnotationRegistry;
 use Symfony\Bridge\PhpUnit\DeprecationErrorHandler;
 
+// Replace the native phpunit Blacklist, it's a broken artifact from the past
+require_once __DIR__.'/Blacklist.php';
+
 // Detect if we need to serialize deprecations to a file.
 if ($file = getenv('SYMFONY_DEPRECATIONS_SERIALIZE')) {
     DeprecationErrorHandler::collectDeprecations($file);

src/Symfony/Bundle/FrameworkBundle/Command/CacheClearCommand.php

@@ -91,6 +91,9 @@ protected function execute(InputInterface $input, OutputInterface $output)
         $io->comment(sprintf('Clearing the cache for the <info>%s</info> environment with debug <info>%s</info>', $kernel->getEnvironment(), var_export($kernel->isDebug(), true)));
         $this->cacheClearer->clear($realCacheDir);
 
+        // The current event dispatcher is stale, let's not use it anymore
+        $this->getApplication()->setDispatcher(new EventDispatcher());
+
         if ($input->getOption('no-warmup')) {
             $this->filesystem->rename($realCacheDir, $oldCacheDir);
         } else {
@@ -103,9 +106,6 @@ protected function execute(InputInterface $input, OutputInterface $output)
 
         $this->filesystem->remove($oldCacheDir);
 
-        // The current event dispatcher is stale, let's not use it anymore
-        $this->getApplication()->setDispatcher(new EventDispatcher());
-
         if ($output->isVerbose()) {
             $io->comment('Finished');
         }

src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Compiler/AddSessionDomainConstraintPassTest.php

@@ -126,7 +126,8 @@ private function createContainer($sessionStorageOptions)
         $ext = new SecurityExtension();
         $ext->load($config, $container);
 
-        (new AddSessionDomainConstraintPass())->process($container);
+        $pass = new AddSessionDomainConstraintPass();
+        $pass->process($container);
 
         return $container;
     }

src/Symfony/Bundle/WebServerBundle/DependencyInjection/WebServerExtension.php

@@ -11,6 +11,7 @@
 
 namespace Symfony\Bundle\WebServerBundle\DependencyInjection;
 
+use Symfony\Bridge\Monolog\Formatter\ConsoleFormatter;
 use Symfony\Component\DependencyInjection\Extension\Extension;
 use Symfony\Component\DependencyInjection\Loader\XmlFileLoader;
 use Symfony\Component\DependencyInjection\ContainerBuilder;
@@ -25,5 +26,9 @@ public function load(array $configs, ContainerBuilder $container)
     {
         $loader = new XmlFileLoader($container, new FileLocator(__DIR__.'/../Resources/config'));
         $loader->load('webserver.xml');
+
+        if (!class_exists(ConsoleFormatter::class)) {
+            $container->removeDefinition('web_server.command.server_log');
+        }
     }
 }

src/Symfony/Component/Console/Application.php

@@ -442,15 +442,12 @@ public function get($name)
     {
         $this->init();
 
-        if (isset($this->commands[$name])) {
-            $command = $this->commands[$name];
-        } elseif ($this->commandLoader && $this->commandLoader->has($name)) {
-            $command = $this->commandLoader->get($name);
-            $this->add($command);
-        } else {
+        if (!$this->has($name)) {
             throw new CommandNotFoundException(sprintf('The command "%s" does not exist.', $name));
         }
 
+        $command = $this->commands[$name];
+
         if ($this->wantHelps) {
             $this->wantHelps = false;
 
@@ -474,7 +471,7 @@ public function has($name)
     {
         $this->init();
 
-        return isset($this->commands[$name]) || ($this->commandLoader && $this->commandLoader->has($name));
+        return isset($this->commands[$name]) || ($this->commandLoader && $this->commandLoader->has($name) && $this->add($this->commandLoader->get($name)));
     }
 
     /**
@@ -636,7 +633,7 @@ public function all($namespace = null)
 
             $commands = $this->commands;
             foreach ($this->commandLoader->getNames() as $name) {
-                if (!isset($commands[$name])) {
+                if (!isset($commands[$name]) && $this->has($name)) {
                     $commands[$name] = $this->get($name);
                 }
             }
@@ -653,7 +650,7 @@ public function all($namespace = null)
 
         if ($this->commandLoader) {
             foreach ($this->commandLoader->getNames() as $name) {
-                if (!isset($commands[$name]) && $namespace === $this->extractNamespace($name, substr_count($namespace, ':') + 1)) {
+                if (!isset($commands[$name]) && $namespace === $this->extractNamespace($name, substr_count($namespace, ':') + 1) && $this->has($name)) {
                     $commands[$name] = $this->get($name);
                 }
             }
@@ -957,8 +954,8 @@ public function extractNamespace($name, $limit = null)
      * Finds alternative of $name among $collection,
      * if nothing is found in $collection, try in $abbrevs.
      *
-     * @param string             $name       The string
-     * @param array|\Traversable $collection The collection
+     * @param string   $name       The string
+     * @param iterable $collection The collection
      *
      * @return string[] A sorted array of similar string
      */

src/Symfony/Component/Console/Question/Question.php

@@ -117,7 +117,7 @@ public function setHiddenFallback($fallback)
     /**
      * Gets values for the autocompleter.
      *
-     * @return null|array|\Traversable
+     * @return null|iterable
      */
     public function getAutocompleterValues()
     {
@@ -127,7 +127,7 @@ public function getAutocompleterValues()
     /**
      * Sets values for the autocompleter.
      *
-     * @param null|array|\Traversable $values
+     * @param null|iterable $values
      *
      * @return $this
      *