Skip to content

Commit 2e0fcc3

Browse files
nicolas-grekasnicolas-grekas
committed
Merge branch '7.3' into 7.4
* 7.3: [SecurityBundle] Fix semantic configuration for singulars/plurals in XML [JsonPath] Make the component RFC compliant Fix `#[IsCsrfTokenValid]` to ensure `$tokenKey` is non-nullable
2 parents ac219f8 + 84c65cb commit 2e0fcc3

38 files changed

+1050
-348
lines changed

‎src/Symfony/Bundle/DebugBundle/Resources/config/schema/debug-1.0.xsd‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,5 +11,13 @@
1111
<xsd:attribute name="min-depth" type="xsd:integer" />
1212
<xsd:attribute name="max-string-length" type="xsd:integer" />
1313
<xsd:attribute name="dump-destination" type="xsd:string" />
14+
<xsd:attribute name="theme" type="debug_theme" />
1415
</xsd:complexType>
16+
17+
<xsd:simpleType name="debug_theme">
18+
<xsd:restriction base="xsd:string">
19+
<xsd:enumeration value="dark" />
20+
<xsd:enumeration value="light" />
21+
</xsd:restriction>
22+
</xsd:simpleType>
1523
</xsd:schema>

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@ public function getConfigTreeBuilder(): TreeBuilder
8686
})
8787
->end()
8888
->fixXmlConfig('enabled_locale')
89+
->fixXmlConfig('trusted_header')
8990
->children()
9091
->scalarNode('secret')->end()
9192
->booleanNode('http_method_override')
@@ -124,7 +125,6 @@ public function getConfigTreeBuilder(): TreeBuilder
124125
->defaultValue(['%env(default::SYMFONY_TRUSTED_PROXIES)%'])
125126
->end()
126127
->arrayNode('trusted_headers')
127-
->fixXmlConfig('trusted_header')
128128
->performNoDeepMerging()
129129
->beforeNormalization()->ifString()->then(static fn ($v) => $v ? [$v] : [])->end()
130130
->prototype('scalar')->end()
@@ -276,6 +276,7 @@ private function addHttpCacheSection(ArrayNodeDefinition $rootNode): void
276276
->info('HTTP cache configuration')
277277
->canBeEnabled()
278278
->fixXmlConfig('private_header')
279+
->fixXmlConfig('skip_response_header')
279280
->children()
280281
->booleanNode('debug')->defaultValue('%kernel.debug%')->end()
281282
->enumNode('trace_level')

‎src/Symfony/Bundle/FrameworkBundle/Resources/config/schema/symfony-1.0.xsd‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@
4747
<xsd:element name="webhook" type="webhook" minOccurs="0" maxOccurs="1" />
4848
<xsd:element name="remote-event" type="remote-event" minOccurs="0" maxOccurs="1" />
4949
<xsd:element name="json-streamer" type="json-streamer" minOccurs="0" maxOccurs="1" />
50+
<xsd:element name="secrets" type="secrets" minOccurs="0" maxOccurs="1" />
5051
</xsd:choice>
5152

5253
<xsd:attribute name="http-method-override" type="xsd:boolean" />
@@ -62,6 +63,7 @@
6263
<xsd:attribute name="trusted-hosts" type="xsd:string" />
6364
<xsd:attribute name="trusted-proxies" type="xsd:string" />
6465
<xsd:attribute name="trusted-headers" type="xsd:string" />
66+
<xsd:attribute name="disallow-search-engine-index" type="xsd:boolean" />
6567
</xsd:complexType>
6668

6769
<xsd:complexType name="form">
@@ -724,6 +726,7 @@
724726
<xsd:choice maxOccurs="unbounded">
725727
<xsd:element name="resolve" type="http_resolve" minOccurs="0" maxOccurs="unbounded" />
726728
<xsd:element name="header" type="http_header" minOccurs="0" maxOccurs="unbounded" />
729+
<xsd:element name="var" type="http_var" minOccurs="0" maxOccurs="unbounded" />
727730
<xsd:element name="peer-fingerprint" type="fingerprint" minOccurs="0" maxOccurs="unbounded" />
728731
<xsd:element name="retry-failed" type="http_client_retry_failed" minOccurs="0" maxOccurs="1" />
729732
<xsd:element name="extra" type="xsd:anyType" minOccurs="0" maxOccurs="unbounded" />
@@ -818,6 +821,10 @@
818821
<xsd:attribute name="name" type="xsd:string" />
819822
</xsd:complexType>
820823

824+
<xsd:complexType name="http_var" mixed="true">
825+
<xsd:attribute name="name" type="xsd:string" />
826+
</xsd:complexType>
827+
821828
<xsd:complexType name="mailer">
822829
<xsd:sequence>
823830
<xsd:element name="transport" type="mailer_transport" minOccurs="0" maxOccurs="unbounded" />
@@ -875,6 +882,7 @@
875882
<xsd:complexType name="http_cache">
876883
<xsd:sequence>
877884
<xsd:element name="private-header" type="xsd:string" minOccurs="0" maxOccurs="unbounded" />
885+
<xsd:element name="skip-response-header" type="xsd:string" minOccurs="0" maxOccurs="unbounded" />
878886
</xsd:sequence>
879887

880888
<xsd:attribute name="enabled" type="xsd:boolean" />
@@ -1077,4 +1085,11 @@
10771085
<xsd:attribute name="enabled" type="xsd:boolean" />
10781086
</xsd:complexType>
10791087

1088+
<xsd:complexType name="secrets">
1089+
<xsd:attribute name="enabled" type="xsd:boolean" />
1090+
<xsd:attribute name="vault-directory" type="xsd:string" />
1091+
<xsd:attribute name="local-dotenv-file" type="xsd:string" />
1092+
<xsd:attribute name="decryption-env-var" type="xsd:string" />
1093+
</xsd:complexType>
1094+
10801095
</xsd:schema>

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/AccessToken/CasTokenHandlerFactory.php‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@ public function addConfiguration(NodeBuilder $node): void
4242
{
4343
$node
4444
->arrayNode($this->getKey())
45-
->fixXmlConfig($this->getKey())
4645
->children()
4746
->scalarNode('validation_url')
4847
->info('CAS server validation URL')

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/AccessToken/OidcTokenHandlerFactory.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,8 +90,8 @@ public function addConfiguration(NodeBuilder $node): void
9090
{
9191
$node
9292
->arrayNode($this->getKey())
93-
->fixXmlConfig($this->getKey())
9493
->fixXmlConfig('issuer')
94+
->fixXmlConfig('algorithm')
9595
->validate()
9696
->ifTrue(static fn ($v) => !isset($v['algorithm']) && !isset($v['algorithms']))
9797
->thenInvalid('You must set either "algorithm" or "algorithms".')
@@ -173,6 +173,7 @@ public function addConfiguration(NodeBuilder $node): void
173173
->info('JSON-encoded JWKSet used to sign the token (must contain a list of valid public keys).')
174174
->end()
175175
->arrayNode('encryption')
176+
->fixXmlConfig('algorithm')
176177
->canBeEnabled()
177178
->children()
178179
->booleanNode('enforce')

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/AccessToken/OidcUserInfoTokenHandlerFactory.php‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,6 @@ public function addConfiguration(NodeBuilder $node): void
6363
{
6464
$node
6565
->arrayNode($this->getKey())
66-
->fixXmlConfig($this->getKey())
6766
->beforeNormalization()
6867
->ifString()
6968
->then(fn ($v) => ['claim' => 'sub', 'base_uri' => $v])

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/AccessTokenFactory.php‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,11 +43,10 @@ public function addConfiguration(NodeDefinition $node): void
4343
{
4444
parent::addConfiguration($node);
4545

46-
$builder = $node->children();
46+
$builder = $node->fixXmlConfig('token_extractor')->children();
4747
$builder
4848
->scalarNode('realm')->defaultNull()->end()
4949
->arrayNode('token_extractors')
50-
->fixXmlConfig('token_extractors')
5150
->beforeNormalization()
5251
->ifString()
5352
->then(fn ($v) => [$v])

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/RememberMeFactory.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ public function getKey(): string
126126
public function addConfiguration(NodeDefinition $node): void
127127
{
128128
$builder = $node
129+
->fixXmlConfig('signature_property', 'signature_properties')
129130
->fixXmlConfig('user_provider')
130131
->children()
131132
;

‎src/Symfony/Bundle/SecurityBundle/Resources/config/schema/security-1.0.xsd‎

Lines changed: 37 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -9,40 +9,19 @@
99
<xsd:complexType name="config">
1010
<xsd:choice maxOccurs="unbounded">
1111
<xsd:element name="access-decision-manager" type="access_decision_manager" minOccurs="0" maxOccurs="1" />
12-
<xsd:element name="password_hashers" type="password_hashers" minOccurs="0" maxOccurs="1" />
13-
<xsd:element name="password_hasher" type="password_hasher" minOccurs="0" maxOccurs="unbounded" />
14-
<xsd:element name="providers" type="providers" minOccurs="0" maxOccurs="1" />
12+
<xsd:element name="password-hasher" type="password_hasher" minOccurs="0" maxOccurs="unbounded" />
1513
<xsd:element name="provider" type="provider" minOccurs="0" maxOccurs="unbounded" />
16-
<xsd:element name="firewalls" type="firewalls" minOccurs="0" maxOccurs="1" />
1714
<xsd:element name="firewall" type="firewall" minOccurs="0" maxOccurs="unbounded" />
1815
<xsd:element name="rule" type="rule" minOccurs="0" maxOccurs="unbounded" />
1916
<xsd:element name="role" type="role" minOccurs="0" maxOccurs="unbounded" />
2017
</xsd:choice>
2118
<xsd:attribute name="access-denied-url" type="xsd:string" />
2219
<xsd:attribute name="session-fixation-strategy" type="session_fixation_strategy" />
2320
<xsd:attribute name="hide-user-not-found" type="xsd:boolean" />
24-
<xsd:attribute name="always-authenticate-before-granting" type="xsd:boolean" />
21+
<xsd:attribute name="expose-security-errors" type="access_decision_manager_expose_security_level" />
2522
<xsd:attribute name="erase-credentials" type="xsd:boolean" />
2623
</xsd:complexType>
2724

28-
<xsd:complexType name="password_hashers">
29-
<xsd:sequence>
30-
<xsd:element name="password_hasher" type="password_hasher" minOccurs="1" maxOccurs="unbounded" />
31-
</xsd:sequence>
32-
</xsd:complexType>
33-
34-
<xsd:complexType name="providers">
35-
<xsd:sequence>
36-
<xsd:element name="provider" type="provider" minOccurs="1" maxOccurs="unbounded" />
37-
</xsd:sequence>
38-
</xsd:complexType>
39-
40-
<xsd:complexType name="firewalls">
41-
<xsd:sequence>
42-
<xsd:element name="firewall" type="firewall" minOccurs="1" maxOccurs="unbounded" />
43-
</xsd:sequence>
44-
</xsd:complexType>
45-
4625
<xsd:simpleType name="session_fixation_strategy">
4726
<xsd:restriction base="xsd:string">
4827
<xsd:enumeration value="none" />
@@ -55,7 +34,6 @@
5534
<xsd:attribute name="strategy" type="access_decision_manager_strategy" />
5635
<xsd:attribute name="service" type="xsd:string" />
5736
<xsd:attribute name="strategy-service" type="xsd:string" />
58-
<xsd:attribute name="expose-security-errors" type="access_decision_manager_expose_security_level" />
5937
<xsd:attribute name="allow-if-all-abstain" type="xsd:boolean" />
6038
<xsd:attribute name="allow-if-equal-granted-denied" type="xsd:boolean" />
6139
</xsd:complexType>
@@ -196,12 +174,16 @@
196174
<xsd:attribute name="name" type="xsd:string" use="required" />
197175
<xsd:attribute name="path" type="xsd:string" />
198176
<xsd:attribute name="domain" type="xsd:string" />
177+
<xsd:attribute name="secure" type="xsd:boolean" />
178+
<xsd:attribute name="samesite" type="remember_me_samesite" />
179+
<xsd:attribute name="partitioned" type="xsd:boolean" />
199180
</xsd:complexType>
200181

201182
<xsd:complexType name="switch_user">
202183
<xsd:attribute name="provider" type="xsd:string" />
203184
<xsd:attribute name="parameter" type="xsd:string" />
204185
<xsd:attribute name="role" type="xsd:string" />
186+
<xsd:attribute name="target-route" type="xsd:string" />
205187
</xsd:complexType>
206188

207189
<xsd:complexType name="anonymous">
@@ -304,6 +286,7 @@
304286
<xsd:attribute name="success-handler" type="xsd:string" />
305287
<xsd:attribute name="failure-handler" type="xsd:string" />
306288
<xsd:attribute name="provider" type="xsd:string" />
289+
<xsd:attribute name="secret" type="xsd:string" />
307290
</xsd:complexType>
308291

309292
<xsd:complexType name="access_token">
@@ -321,59 +304,66 @@
321304
<xsd:complexType name="oidc_token_handler">
322305
<xsd:sequence>
323306
<xsd:choice minOccurs="0" maxOccurs="1">
324-
<xsd:element name="oidc-user-info" type="oidc_user_info"></xsd:element>
325-
<xsd:element name="oidc" type="oidc"></xsd:element>
307+
<xsd:element name="oidc-user-info" type="oidc_user_info" />
308+
<xsd:element name="oidc" type="oidc" />
326309
</xsd:choice>
327310
</xsd:sequence>
328-
<xsd:attribute name="oidc-user-info" type="xsd:anyURI"></xsd:attribute>
311+
<xsd:attribute name="oidc-user-info" type="xsd:string" />
329312
</xsd:complexType>
330313

331314
<xsd:complexType name="oidc_user_info">
332-
<xsd:attribute name="base-uri" type="xsd:anyURI" use="required" />
315+
<xsd:sequence>
316+
<xsd:element name="discovery" minOccurs="0" maxOccurs="1">
317+
<xsd:complexType>
318+
<xsd:sequence>
319+
<xsd:element name="cache" minOccurs="0" maxOccurs="1">
320+
<xsd:complexType>
321+
<xsd:attribute name="id" type="xsd:string" />
322+
</xsd:complexType>
323+
</xsd:element>
324+
</xsd:sequence>
325+
</xsd:complexType>
326+
</xsd:element>
327+
</xsd:sequence>
328+
<xsd:attribute name="base-uri" type="xsd:string" use="required" />
333329
<xsd:attribute name="claim" type="xsd:string" />
334330
<xsd:attribute name="client" type="xsd:string" />
335331
</xsd:complexType>
336332

337333
<xsd:complexType name="oidc">
338334
<xsd:choice maxOccurs="unbounded">
339-
<xsd:element name="issuers" type="oidc_issuers" minOccurs="0" maxOccurs="1" />
340-
<xsd:element name="issuer" type="password_hasher" minOccurs="0" maxOccurs="unbounded" />
335+
<xsd:element name="issuer" type="xsd:string" minOccurs="1" maxOccurs="unbounded" />
336+
<xsd:element name="algorithm" type="xsd:string" minOccurs="1" maxOccurs="unbounded" />
341337
<xsd:element name="encryption" type="oidc_encryption" />
342338
</xsd:choice>
343339
<xsd:attribute name="claim" type="xsd:string" />
344340
<xsd:attribute name="audience" type="xsd:string" use="required" />
345-
<xsd:attribute name="algorithm" type="xsd:string" use="required" />
346-
<xsd:attribute name="key" type="xsd:string" use="required" />
341+
<xsd:attribute name="algorithm" type="xsd:string" />
342+
<xsd:attribute name="key" type="xsd:string" />
343+
<xsd:attribute name="keyset" type="xsd:string" />
347344
</xsd:complexType>
348345

349346
<xsd:complexType name="oidc_encryption">
350347
<xsd:choice maxOccurs="unbounded">
351-
<xsd:element name="algorithms" type="oidc_encryption_algorithms" minOccurs="1" maxOccurs="1" />
348+
<xsd:element name="algorithm" type="xsd:string" minOccurs="1" maxOccurs="unbounded" />
352349
</xsd:choice>
353350
<xsd:attribute name="enabled" type="xsd:boolean" />
354351
<xsd:attribute name="enforce" type="xsd:boolean" />
355352
<xsd:attribute name="keyset" type="xsd:string" use="required" />
356353
</xsd:complexType>
357354

358-
<xsd:complexType name="oidc_encryption_algorithms">
359-
<xsd:sequence>
360-
<xsd:element name="algorithm" type="xsd:string" minOccurs="1" maxOccurs="unbounded" />
361-
</xsd:sequence>
362-
</xsd:complexType>
363-
364-
<xsd:complexType name="oidc_issuers">
365-
<xsd:sequence>
366-
<xsd:element name="issuer" type="xsd:string" minOccurs="1" maxOccurs="unbounded" />
367-
</xsd:sequence>
368-
</xsd:complexType>
369-
370355
<xsd:complexType name="login_throttling">
371356
<xsd:attribute name="limiter" type="xsd:string" />
372357
<xsd:attribute name="max-attempts" type="xsd:integer" />
358+
<xsd:attribute name="interval" type="xsd:string" />
359+
<xsd:attribute name="lock-factory" type="xsd:string" />
373360
</xsd:complexType>
374361

375362
<xsd:complexType name="remember_me">
376363
<xsd:sequence minOccurs="0">
364+
<xsd:choice minOccurs="0" maxOccurs="unbounded">
365+
<xsd:element name="signature-property" type="xsd:string" />
366+
</xsd:choice>
377367
<xsd:choice minOccurs="0" maxOccurs="unbounded">
378368
<xsd:element name="user-provider" type="xsd:string" />
379369
</xsd:choice>
@@ -442,7 +432,7 @@
442432
<xsd:element name="method" type="xsd:string" minOccurs="0" maxOccurs="unbounded" />
443433
<xsd:element name="role" type="xsd:string" minOccurs="0" maxOccurs="unbounded" />
444434
<xsd:element name="allow-if" type="xsd:string" minOccurs="0" maxOccurs="1" />
445-
<xsd:element name="attribute" type="rule_attribute" minOccurs="0" maxOccurs="1" />
435+
<xsd:element name="attribute" type="rule_attribute" minOccurs="0" maxOccurs="unbounded" />
446436
</xsd:choice>
447437
<xsd:attribute name="requires-channel" type="xsd:string" />
448438
<xsd:attribute name="path" type="xsd:string" />
@@ -452,6 +442,7 @@
452442
<xsd:attribute name="methods" type="xsd:string" />
453443
<xsd:attribute name="allow-if" type="xsd:string" />
454444
<xsd:attribute name="route" type="xsd:string" />
445+
<xsd:attribute name="request-matcher" type="xsd:string" />
455446
</xsd:complexType>
456447

457448
<xsd:complexType name="role">

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/CompleteConfigurationTestCase.php‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -726,6 +726,41 @@ public function testFirewallPatterns()
726726
$this->assertSame('(?:^/register$|^/documentation$)', $container->getDefinition($requestMatcherId)->getArgument(0));
727727
}
728728

729+
public function testAccessTokenOidc()
730+
{
731+
$container = $this->getContainer('access_token_oidc');
732+
733+
$this->assertTrue($container->hasDefinition('security.authenticator.access_token.firewall1'));
734+
$this->assertTrue($container->hasDefinition('security.access_token_handler.firewall1'));
735+
736+
$def = $container->getDefinition('security.access_token_handler.firewall1');
737+
$this->assertSame('audience', $def->getArgument(2));
738+
$this->assertSame(['https://www.example.com'], $def->getArgument(3));
739+
$this->assertSame('sub', $def->getArgument(4));
740+
}
741+
742+
public function testAccessTokenOidcWithEncryption()
743+
{
744+
$container = $this->getContainer('access_token_oidc_encryption');
745+
746+
$this->assertTrue($container->hasDefinition('security.authenticator.access_token.firewall1'));
747+
$this->assertTrue($container->hasDefinition('security.access_token_handler.firewall1'));
748+
749+
$def = $container->getDefinition('security.access_token_handler.firewall1');
750+
$this->assertSame(['RS256'], $def->getArgument(0)->getArgument(0));
751+
}
752+
753+
public function testAccessTokenOidcUserInfoWithDiscovery()
754+
{
755+
if ('xml' === $this->getFileExtension()) {
756+
$this->markTestSkipped('OIDC user info discovery is not supported by the XML schema.');
757+
}
758+
$container = $this->getContainer('access_token_oidc_user_info_discovery');
759+
760+
$this->assertTrue($container->hasDefinition('security.authenticator.access_token.firewall1'));
761+
$this->assertTrue($container->hasDefinition('security.access_token_handler.firewall1'));
762+
}
763+
729764
protected function getContainer($file)
730765
{
731766
$file .= '.'.$this->getFileExtension();

0 commit comments

Comments
 (0)