Merge branch '6.4' into 7.3

* 6.4:
  Replace backtick operator, deprecated in PHP 8.5, with shell_exec()
  [DependencyInjection] Add test case to ensure XML parse exception message includes filename and position
  [Serializer] Fix normalizing objects with accessors having the same name as a property
  [SecurityBundle] Prevent accessing the tracked token storage when collecting data

Author: nicolas-grekas

src/Symfony/Bridge/PhpUnit/bin/simple-phpunit.php

@@ -194,7 +194,7 @@
     }
 
     $info = [];
-    foreach (explode("\n", `$COMPOSER info --no-ansi -a -n phpunit/phpunit "$PHPUNIT_VERSION.*"`) as $line) {
+    foreach (explode("\n", shell_exec("$COMPOSER info --no-ansi -a -n phpunit/phpunit \"$PHPUNIT_VERSION.*\"")) as $line) {
         $line = rtrim($line);
 
         if (!$info && preg_match('/^versions +: /', $line)) {

src/Symfony/Bundle/SecurityBundle/DataCollector/SecurityDataCollector.php

@@ -101,10 +101,12 @@ public function collect(Request $request, Response $response, ?\Throwable $excep
             }
 
             $logoutUrl = null;
-            try {
-                $logoutUrl = $this->logoutUrlGenerator?->getLogoutPath();
-            } catch (\Exception) {
-                // fail silently when the logout URL cannot be generated
+            if ($this->logoutUrlGenerator && method_exists($token, 'getFirewallName')) {
+                try {
+                    $logoutUrl = $this->logoutUrlGenerator->getLogoutPath($token->getFirewallName());
+                } catch (\Exception) {
+                    // fail silently when the logout URL cannot be generated
+                }
             }
 
             $this->data = [

src/Symfony/Component/DependencyInjection/Tests/Fixtures/xml/services31.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<container xmlns="http://symfony.com/schema/dic/services" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://symfony.com/schema/dic/services https://symfony.com/schema/dic/services/services-1.0.xsd">
+    <services>
+        <service id="invalid_service" class="App\Foo">
+            <bogusTag />
+        </service>
+    </services>
+</container>

src/Symfony/Component/DependencyInjection/Tests/Loader/XmlFileLoaderTest.php

@@ -1362,4 +1362,20 @@ public function testLoadServicesWithEnvironment()
 
         self::assertInstanceOf(RemoteCallerSocket::class, $container->get(RemoteCaller::class));
     }
+
+    public function testXmlParseExceptionIncludesFilenameAndPosition()
+    {
+        $container = new ContainerBuilder();
+        $loader = new XmlFileLoader(
+            $container,
+            new FileLocator(__DIR__.'/../Fixtures/xml')
+        );
+
+        $invalidXMLFileName = 'services31.xml';
+
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessageMatches('/Unable to parse file .*services31\.xml.*bogusTag.*This element is not expected.*line 5, column 0/');
+
+        $loader->load($invalidXMLFileName);
+    }
 }

src/Symfony/Component/Serializer/Normalizer/ObjectNormalizer.php

@@ -88,24 +88,21 @@ protected function extractAttributes(object $object, ?string $format = null, arr
             $attributeName = null;
 
             // ctype_lower check to find out if method looks like accessor but actually is not, e.g. hash, cancel
-            if (3 < \strlen($name) && !ctype_lower($name[3]) && match ($name[0]) {
-                'g' => str_starts_with($name, 'get'),
-                'h' => str_starts_with($name, 'has'),
-                'c' => str_starts_with($name, 'can'),
+            if (match ($name[0]) {
+                'g' => str_starts_with($name, 'get') && isset($name[$i = 3]),
+                'h' => str_starts_with($name, 'has') && isset($name[$i = 3]),
+                'c' => str_starts_with($name, 'can') && isset($name[$i = 3]),
+                'i' => str_starts_with($name, 'is') && isset($name[$i = 2]),
                 default => false,
-            }) {
-                // getters, hassers and canners
-                $attributeName = substr($name, 3);
-
-                if (!$reflClass->hasProperty($attributeName)) {
-                    $attributeName = lcfirst($attributeName);
-                }
-            } elseif ('is' !== $name && str_starts_with($name, 'is') && !ctype_lower($name[2])) {
-                // issers
-                $attributeName = substr($name, 2);
-
-                if (!$reflClass->hasProperty($attributeName)) {
-                    $attributeName = lcfirst($attributeName);
+            } && !ctype_lower($name[$i])) {
+                if ($reflClass->hasProperty($name)) {
+                    $attributeName = $name;
+                } else {
+                    $attributeName = substr($name, $i);
+
+                    if (!$reflClass->hasProperty($attributeName)) {
+                        $attributeName = lcfirst($attributeName);
+                    }
                 }
             }
 

src/Symfony/Component/Serializer/Tests/Normalizer/ObjectNormalizerTest.php

@@ -980,6 +980,20 @@ public function testNormalizeWithMethodNamesSimilarToAccessors()
             123 => 321,
         ], $normalized);
     }
+
+    public function testNormalizeObjectWithBooleanPropertyAndIsserMethodWithSameName()
+    {
+        $classMetadataFactory = new ClassMetadataFactory(new AttributeLoader());
+        $normalizer = new ObjectNormalizer($classMetadataFactory);
+
+        $object = new ObjectWithBooleanPropertyAndIsserWithSameName();
+        $normalized = $normalizer->normalize($object);
+
+        $this->assertSame([
+            'foo' => 'foo',
+            'isFoo' => true,
+        ], $normalized);
+    }
 }
 
 class ProxyObjectDummy extends ObjectDummy
@@ -1322,3 +1336,19 @@ public function isolate()
         $this->accessorishCalled = true;
     }
 }
+
+class ObjectWithBooleanPropertyAndIsserWithSameName
+{
+    private $foo = 'foo';
+    private $isFoo = true;
+
+    public function getFoo()
+    {
+        return $this->foo;
+    }
+
+    public function isFoo()
+    {
+        return $this->isFoo;
+    }
+}