From c89750fe94fa6b90eca6ed8c6cf7607fccee3b0d Mon Sep 17 00:00:00 2001 From: Kevin Papst Date: Sat, 21 Mar 2020 00:21:06 +0100 Subject: [PATCH] ensure user attributes are truncated (#1580) --- composer.json | 7 +- composer.lock | 196 +++++++------------------------ src/Entity/InvoiceTemplate.php | 2 +- src/Entity/User.php | 10 +- src/Export/Base/XlsxRenderer.php | 2 +- src/Utils/StringHelper.php | 26 ++++ symfony.lock | 6 - tests/Entity/UserTest.php | 19 +++ tests/Utils/StringHelperTest.php | 31 +++++ 9 files changed, 133 insertions(+), 166 deletions(-) create mode 100644 src/Utils/StringHelper.php create mode 100644 tests/Utils/StringHelperTest.php diff --git a/composer.json b/composer.json index 344337ee..4884ca11 100644 --- a/composer.json +++ b/composer.json @@ -121,10 +121,15 @@ } }, "replace": { + "symfony/polyfill-mbstring": "*", + "symfony/polyfill-intl": "*", "symfony/polyfill-iconv": "*", + "symfony/polyfill-php72": "*", "symfony/polyfill-php71": "*", "symfony/polyfill-php70": "*", - "symfony/polyfill-php56": "*" + "symfony/polyfill-php56": "*", + "symfony/polyfill-php55": "*", + "symfony/polyfill-php54": "*" }, "suggest": { "ext-mbstring": "If ext-mbstring is not available you MUST install symfony/polyfill-mbstring", diff --git a/composer.lock b/composer.lock index 5924be7f..ffdbdbbf 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "0d02096214d52a2a623854b2f486e197", + "content-hash": "569f570147f4a21f65f83938d3128824", "packages": [ { "name": "beberlei/doctrineextensions", @@ -2484,7 +2484,7 @@ }, { "name": "illuminate/cache", - "version": "v7.1.1", + "version": "v7.2.2", "source": { "type": "git", "url": "https://github.com/illuminate/cache.git", @@ -2535,16 +2535,16 @@ }, { "name": "illuminate/contracts", - "version": "v7.1.1", + "version": "v7.2.2", "source": { "type": "git", "url": "https://github.com/illuminate/contracts.git", - "reference": "10eb9fd5014e80296d254ae38ff1afe52d515a66" + "reference": "075d70c8d621e474d10279bf62c19e121be30e95" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/illuminate/contracts/zipball/10eb9fd5014e80296d254ae38ff1afe52d515a66", - "reference": "10eb9fd5014e80296d254ae38ff1afe52d515a66", + "url": "https://api.github.com/repos/illuminate/contracts/zipball/075d70c8d621e474d10279bf62c19e121be30e95", + "reference": "075d70c8d621e474d10279bf62c19e121be30e95", "shasum": "" }, "require": { @@ -2575,20 +2575,20 @@ ], "description": "The Illuminate Contracts package.", "homepage": "https://laravel.com", - "time": "2020-03-09T13:23:43+00:00" + "time": "2020-03-16T13:40:39+00:00" }, { "name": "illuminate/support", - "version": "v7.1.1", + "version": "v7.2.2", "source": { "type": "git", "url": "https://github.com/illuminate/support.git", - "reference": "ca1af56ffbac9361da042e6ee0ad4ebcbbbae515" + "reference": "91066b0b829ea0ab1315eeaefbe7f191cc31d7a1" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/illuminate/support/zipball/ca1af56ffbac9361da042e6ee0ad4ebcbbbae515", - "reference": "ca1af56ffbac9361da042e6ee0ad4ebcbbbae515", + "url": "https://api.github.com/repos/illuminate/support/zipball/91066b0b829ea0ab1315eeaefbe7f191cc31d7a1", + "reference": "91066b0b829ea0ab1315eeaefbe7f191cc31d7a1", "shasum": "" }, "require": { @@ -2637,7 +2637,7 @@ ], "description": "The Illuminate Support package.", "homepage": "https://laravel.com", - "time": "2020-03-12T12:48:26+00:00" + "time": "2020-03-17T14:26:31+00:00" }, { "name": "intervention/image", @@ -3225,33 +3225,33 @@ }, { "name": "league/csv", - "version": "9.5.0", + "version": "9.6.0", "source": { "type": "git", "url": "https://github.com/thephpleague/csv.git", - "reference": "b348d09d0d258a4f068efb50a2510dc63101c213" + "reference": "7351a74625601914409b42b32cabb91a93773b7b" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/thephpleague/csv/zipball/b348d09d0d258a4f068efb50a2510dc63101c213", - "reference": "b348d09d0d258a4f068efb50a2510dc63101c213", + "url": "https://api.github.com/repos/thephpleague/csv/zipball/7351a74625601914409b42b32cabb91a93773b7b", + "reference": "7351a74625601914409b42b32cabb91a93773b7b", "shasum": "" }, "require": { - "ext-dom": "*", "ext-json": "*", "ext-mbstring": "*", - "php": ">=7.0.10" + "php": "^7.2.5" }, "require-dev": { "ext-curl": "*", - "friendsofphp/php-cs-fixer": "^2.12", - "phpstan/phpstan": "^0.9.2", - "phpstan/phpstan-phpunit": "^0.9.4", - "phpstan/phpstan-strict-rules": "^0.9.0", - "phpunit/phpunit": "^6.0" + "friendsofphp/php-cs-fixer": "^2.16", + "phpstan/phpstan": "^0.12.0", + "phpstan/phpstan-phpunit": "^0.12.0", + "phpstan/phpstan-strict-rules": "^0.12.0", + "phpunit/phpunit": "^8.0" }, "suggest": { + "ext-dom": "Required to use the XMLConverter and or the HTMLConverter classes", "ext-iconv": "Needed to ease transcoding CSV using iconv stream filters" }, "type": "library", @@ -3280,17 +3280,19 @@ "role": "Developer" } ], - "description": "Csv data manipulation made easy in PHP", + "description": "CSV data manipulation made easy in PHP", "homepage": "http://csv.thephpleague.com", "keywords": [ + "convert", "csv", "export", "filter", "import", "read", + "transform", "write" ], - "time": "2019-12-15T19:51:41+00:00" + "time": "2020-03-17T15:15:35+00:00" }, { "name": "league/html-to-markdown", @@ -7661,120 +7663,6 @@ ], "time": "2020-01-13T11:15:53+00:00" }, - { - "name": "symfony/polyfill-mbstring", - "version": "v1.14.0", - "source": { - "type": "git", - "url": "https://github.com/symfony/polyfill-mbstring.git", - "reference": "34094cfa9abe1f0f14f48f490772db7a775559f2" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/34094cfa9abe1f0f14f48f490772db7a775559f2", - "reference": "34094cfa9abe1f0f14f48f490772db7a775559f2", - "shasum": "" - }, - "require": { - "php": ">=5.3.3" - }, - "suggest": { - "ext-mbstring": "For best performance" - }, - "type": "library", - "extra": { - "branch-alias": { - "dev-master": "1.14-dev" - } - }, - "autoload": { - "psr-4": { - "Symfony\\Polyfill\\Mbstring\\": "" - }, - "files": [ - "bootstrap.php" - ] - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "authors": [ - { - "name": "Nicolas Grekas", - "email": "p@tchwork.com" - }, - { - "name": "Symfony Community", - "homepage": "https://symfony.com/contributors" - } - ], - "description": "Symfony polyfill for the Mbstring extension", - "homepage": "https://symfony.com", - "keywords": [ - "compatibility", - "mbstring", - "polyfill", - "portable", - "shim" - ], - "time": "2020-01-13T11:15:53+00:00" - }, - { - "name": "symfony/polyfill-php72", - "version": "v1.14.0", - "source": { - "type": "git", - "url": "https://github.com/symfony/polyfill-php72.git", - "reference": "46ecacf4751dd0dc81e4f6bf01dbf9da1dc1dadf" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/symfony/polyfill-php72/zipball/46ecacf4751dd0dc81e4f6bf01dbf9da1dc1dadf", - "reference": "46ecacf4751dd0dc81e4f6bf01dbf9da1dc1dadf", - "shasum": "" - }, - "require": { - "php": ">=5.3.3" - }, - "type": "library", - "extra": { - "branch-alias": { - "dev-master": "1.14-dev" - } - }, - "autoload": { - "psr-4": { - "Symfony\\Polyfill\\Php72\\": "" - }, - "files": [ - "bootstrap.php" - ] - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "authors": [ - { - "name": "Nicolas Grekas", - "email": "p@tchwork.com" - }, - { - "name": "Symfony Community", - "homepage": "https://symfony.com/contributors" - } - ], - "description": "Symfony polyfill backporting some PHP 7.2+ features to lower PHP versions", - "homepage": "https://symfony.com", - "keywords": [ - "compatibility", - "polyfill", - "portable", - "shim" - ], - "time": "2020-01-13T11:15:53+00:00" - }, { "name": "symfony/polyfill-php73", "version": "v1.14.0", @@ -9788,16 +9676,16 @@ }, { "name": "voku/portable-ascii", - "version": "1.4.9", + "version": "1.4.10", "source": { "type": "git", "url": "https://github.com/voku/portable-ascii.git", - "reference": "9fd2b224c71448b5f84aef9d499a1428d79776a2" + "reference": "240e93829a5f985fab0984a6e55ae5e26b78a334" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/voku/portable-ascii/zipball/9fd2b224c71448b5f84aef9d499a1428d79776a2", - "reference": "9fd2b224c71448b5f84aef9d499a1428d79776a2", + "url": "https://api.github.com/repos/voku/portable-ascii/zipball/240e93829a5f985fab0984a6e55ae5e26b78a334", + "reference": "240e93829a5f985fab0984a6e55ae5e26b78a334", "shasum": "" }, "require": { @@ -9833,7 +9721,7 @@ "clean", "php" ], - "time": "2020-03-06T02:47:42+00:00" + "time": "2020-03-13T01:23:26+00:00" }, { "name": "webmozart/assert", @@ -10900,16 +10788,16 @@ }, { "name": "phpstan/phpstan", - "version": "0.12.14", + "version": "0.12.17", "source": { "type": "git", "url": "https://github.com/phpstan/phpstan.git", - "reference": "37bdd26a80235d0f9045b49f4151102b7831cbe2" + "reference": "b2c37bda79fdb11d801ce208ce391cffc0f572e6" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/phpstan/phpstan/zipball/37bdd26a80235d0f9045b49f4151102b7831cbe2", - "reference": "37bdd26a80235d0f9045b49f4151102b7831cbe2", + "url": "https://api.github.com/repos/phpstan/phpstan/zipball/b2c37bda79fdb11d801ce208ce391cffc0f572e6", + "reference": "b2c37bda79fdb11d801ce208ce391cffc0f572e6", "shasum": "" }, "require": { @@ -10935,20 +10823,20 @@ "MIT" ], "description": "PHPStan - PHP Static Analysis Tool", - "time": "2020-03-02T22:29:43+00:00" + "time": "2020-03-17T15:39:11+00:00" }, { "name": "phpstan/phpstan-doctrine", - "version": "0.12.9", + "version": "0.12.10", "source": { "type": "git", "url": "https://github.com/phpstan/phpstan-doctrine.git", - "reference": "af14feb2ed259f9eb16d3107e63d85ed516e30af" + "reference": "601f343b05875074454ca72702204592f8844f7d" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/phpstan/phpstan-doctrine/zipball/af14feb2ed259f9eb16d3107e63d85ed516e30af", - "reference": "af14feb2ed259f9eb16d3107e63d85ed516e30af", + "url": "https://api.github.com/repos/phpstan/phpstan-doctrine/zipball/601f343b05875074454ca72702204592f8844f7d", + "reference": "601f343b05875074454ca72702204592f8844f7d", "shasum": "" }, "require": { @@ -10999,7 +10887,7 @@ "MIT" ], "description": "Doctrine extensions for PHPStan", - "time": "2020-01-10T12:31:37+00:00" + "time": "2020-03-13T13:03:08+00:00" }, { "name": "phpstan/phpstan-phpunit", diff --git a/src/Entity/InvoiceTemplate.php b/src/Entity/InvoiceTemplate.php index e07e8634..19e522aa 100644 --- a/src/Entity/InvoiceTemplate.php +++ b/src/Entity/InvoiceTemplate.php @@ -23,7 +23,7 @@ use Symfony\Component\Validator\Constraints as Assert; class InvoiceTemplate { /** - * @var int + * @var int|null * * @ORM\Column(name="id", type="integer") * @ORM\Id diff --git a/src/Entity/User.php b/src/Entity/User.php index ec7d9b98..585ee071 100644 --- a/src/Entity/User.php +++ b/src/Entity/User.php @@ -9,6 +9,7 @@ namespace App\Entity; +use App\Utils\StringHelper; use Doctrine\Common\Collections\ArrayCollection; use Doctrine\Common\Collections\Collection; use Doctrine\ORM\Mapping as ORM; @@ -55,7 +56,7 @@ class User extends BaseUser implements UserInterface * @var string * * @ORM\Column(name="alias", type="string", length=60, nullable=true) - * @Assert\Length(max=160) + * @Assert\Length(max=60) */ private $alias; @@ -70,6 +71,7 @@ class User extends BaseUser implements UserInterface * @var string * * @ORM\Column(name="title", type="string", length=50, nullable=true) + * @Assert\Length(max=50) */ private $title; @@ -77,6 +79,7 @@ class User extends BaseUser implements UserInterface * @var string * * @ORM\Column(name="avatar", type="string", length=255, nullable=true) + * @Assert\Length(max=255) */ private $avatar; @@ -119,6 +122,7 @@ class User extends BaseUser implements UserInterface * @var string * * @ORM\Column(name="auth", type="string", length=20, nullable=true) + * @Assert\Length(max=20) */ private $auth = self::AUTH_INTERNAL; @@ -152,7 +156,7 @@ class User extends BaseUser implements UserInterface public function setAlias(?string $alias): User { - $this->alias = $alias; + $this->alias = StringHelper::ensureMaxLength($alias, 60); return $this; } @@ -169,7 +173,7 @@ class User extends BaseUser implements UserInterface public function setTitle(?string $title): User { - $this->title = $title; + $this->title = StringHelper::ensureMaxLength($title, 50); return $this; } diff --git a/src/Export/Base/XlsxRenderer.php b/src/Export/Base/XlsxRenderer.php index 18aa33f5..068e1834 100644 --- a/src/Export/Base/XlsxRenderer.php +++ b/src/Export/Base/XlsxRenderer.php @@ -58,7 +58,7 @@ class XlsxRenderer extends AbstractSpreadsheetRenderer $col = $sheet->getColumnDimension($column); // If no other width is specified (which defaults to -1) - if ($col->getWidth() === -1) { + if ((int) $col->getWidth() === -1) { $col->setAutoSize(true); } } diff --git a/src/Utils/StringHelper.php b/src/Utils/StringHelper.php new file mode 100644 index 00000000..fec958ae --- /dev/null +++ b/src/Utils/StringHelper.php @@ -0,0 +1,26 @@ + $length) { + $string = mb_substr($string, 0, $length); + } + + return $string; + } +} diff --git a/symfony.lock b/symfony.lock index 0eb51ecc..9b0bb23f 100644 --- a/symfony.lock +++ b/symfony.lock @@ -633,12 +633,6 @@ "symfony/polyfill-intl-normalizer": { "version": "v1.13.1" }, - "symfony/polyfill-mbstring": { - "version": "v1.6.0" - }, - "symfony/polyfill-php72": { - "version": "v1.6.0" - }, "symfony/polyfill-php73": { "version": "v1.11.0" }, diff --git a/tests/Entity/UserTest.php b/tests/Entity/UserTest.php index cb76d7ed..1010c7ab 100644 --- a/tests/Entity/UserTest.php +++ b/tests/Entity/UserTest.php @@ -174,6 +174,25 @@ class UserTest extends TestCase self::assertTrue($sut->isTeamlead()); } + /** + * This functionality was added, because these fields can be set via external providers (LDAP, SAML) and + * an invalid length should not result in errors. + * + * @see #1562 + */ + public function testMaxLength() + { + $sut = new User(); + $sut->setAlias('xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'); + self::assertEquals(60, strlen($sut->getAlias())); + $sut->setAlias('xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxAAAAA'); + self::assertEquals(60, strlen($sut->getAlias())); + $sut->setTitle('xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'); + self::assertEquals(50, strlen($sut->getTitle())); + $sut->setTitle('xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxAAAAAA'); + self::assertEquals(50, strlen($sut->getTitle())); + } + public function testPreferencesCollectionIsCreatedOnBrokenUser() { // this code is only used in some rare edge cases, maybe even only in development ... diff --git a/tests/Utils/StringHelperTest.php b/tests/Utils/StringHelperTest.php new file mode 100644 index 00000000..7409e3d6 --- /dev/null +++ b/tests/Utils/StringHelperTest.php @@ -0,0 +1,31 @@ +