Merge branch '6.4' into 7.3

nicolas-grekas · nicolas-grekas · commit 2a1c07a80574 · 2025-08-18T15:10:53.000+02:00
* 6.4:
  [VarExporter] Fix serializing classes with __serialize() returning unprefixed private properties
  Remove direct access to internal properties cross-components
diff --git a/src/Symfony/Bridge/Doctrine/Tests/Validator/DoctrineLoaderTest.php b/src/Symfony/Bridge/Doctrine/Tests/Validator/DoctrineLoaderTest.php
@@ -214,7 +214,7 @@ public function testClassNoAutoMapping()
 
         /** @var PropertyMetadata[] $autoMappingExplicitlyEnabledMetadata */
         $autoMappingExplicitlyEnabledMetadata = $classMetadata->getPropertyMetadata('autoMappingExplicitlyEnabled');
-        $this->assertCount(1, $autoMappingExplicitlyEnabledMetadata[0]->constraints);
+        $this->assertCount(1, $autoMappingExplicitlyEnabledMetadata[0]->getConstraints());
         $this->assertSame(AutoMappingStrategy::ENABLED, $autoMappingExplicitlyEnabledMetadata[0]->getAutoMappingStrategy());
     }
 }
diff --git a/src/Symfony/Bridge/Twig/Tests/Validator/Constraints/TwigTest.php b/src/Symfony/Bridge/Twig/Tests/Validator/Constraints/TwigTest.php
@@ -27,15 +27,15 @@ public function testAttributes()
         $loader = new AttributeLoader();
         self::assertTrue($loader->loadClassMetadata($metadata));
 
-        [$bConstraint] = $metadata->properties['b']->getConstraints();
+        [$bConstraint] = $metadata->getPropertyMetadata('b')[0]->getConstraints();
         self::assertSame('myMessage', $bConstraint->message);
         self::assertSame(['Default', 'TwigDummy'], $bConstraint->groups);
 
-        [$cConstraint] = $metadata->properties['c']->getConstraints();
+        [$cConstraint] = $metadata->getPropertyMetadata('c')[0]->getConstraints();
         self::assertSame(['my_group'], $cConstraint->groups);
         self::assertSame('some attached data', $cConstraint->payload);
 
-        [$dConstraint] = $metadata->properties['d']->getConstraints();
+        [$dConstraint] = $metadata->getPropertyMetadata('d')[0]->getConstraints();
         self::assertFalse($dConstraint->skipDeprecations);
     }
 }
diff --git a/src/Symfony/Component/Form/Tests/Extension/Validator/ValidatorExtensionTest.php b/src/Symfony/Component/Form/Tests/Extension/Validator/ValidatorExtensionTest.php
@@ -42,8 +42,8 @@ public function test2Dot5ValidationApi()
         $this->assertCount(1, $metadata->getConstraints());
         $this->assertInstanceOf(FormConstraint::class, $metadata->getConstraints()[0]);
 
-        $this->assertSame(CascadingStrategy::NONE, $metadata->cascadingStrategy);
-        $this->assertSame(TraversalStrategy::NONE, $metadata->traversalStrategy);
+        $this->assertSame(CascadingStrategy::NONE, $metadata->getCascadingStrategy());
+        $this->assertSame(TraversalStrategy::NONE, $metadata->getTraversalStrategy());
         $this->assertCount(0, $metadata->getPropertyMetadata('children'));
     }
 }
diff --git a/src/Symfony/Component/Security/Core/Tests/Validator/Constraints/UserPasswordTest.php b/src/Symfony/Component/Security/Core/Tests/Validator/Constraints/UserPasswordTest.php
@@ -42,20 +42,20 @@ public static function provideServiceValidatedConstraints(): iterable
         $metadata = new ClassMetadata(UserPasswordDummy::class);
         self::assertTrue((new AttributeLoader())->loadClassMetadata($metadata));
 
-        yield 'attribute' => [$metadata->properties['b']->constraints[0]];
+        yield 'attribute' => [$metadata->getPropertyMetadata('b')[0]->getConstraints()[0]];
     }
 
     public function testAttributes()
     {
         $metadata = new ClassMetadata(UserPasswordDummy::class);
         self::assertTrue((new AttributeLoader())->loadClassMetadata($metadata));
 
-        [$bConstraint] = $metadata->properties['b']->getConstraints();
+        [$bConstraint] = $metadata->getPropertyMetadata('b')[0]->getConstraints();
         self::assertSame('myMessage', $bConstraint->message);
         self::assertSame(['Default', 'UserPasswordDummy'], $bConstraint->groups);
         self::assertNull($bConstraint->payload);
 
-        [$cConstraint] = $metadata->properties['c']->getConstraints();
+        [$cConstraint] = $metadata->getPropertyMetadata('c')[0]->getConstraints();
         self::assertSame(['my_group'], $cConstraint->groups);
         self::assertSame('some attached data', $cConstraint->payload);
     }
diff --git a/src/Symfony/Component/VarExporter/Internal/Exporter.php b/src/Symfony/Component/VarExporter/Internal/Exporter.php
@@ -76,33 +76,23 @@ public static function prepare($values, $objectsPool, &$refsPool, &$objectsCount
             $class = $value::class;
             $reflector = Registry::$reflectors[$class] ??= Registry::getClassReflector($class);
             $properties = [];
+            $sleep = null;
+            $proto = Registry::$prototypes[$class];
 
             if ($reflector->hasMethod('__serialize')) {
                 if (!$reflector->getMethod('__serialize')->isPublic()) {
                     throw new \Error(\sprintf('Call to %s method "%s::__serialize()".', $reflector->getMethod('__serialize')->isProtected() ? 'protected' : 'private', $class));
                 }
 
-                if (!\is_array($serializeProperties = $value->__serialize())) {
+                if (!\is_array($arrayValue = $value->__serialize())) {
                     throw new \TypeError($class.'::__serialize() must return an array');
                 }
 
                 if ($reflector->hasMethod('__unserialize')) {
-                    $properties = $serializeProperties;
-                } else {
-                    foreach ($serializeProperties as $n => $v) {
-                        $p = $reflector->hasProperty($n) ? $reflector->getProperty($n) : null;
-                        $c = $p && (\PHP_VERSION_ID >= 80400 ? $p->isProtectedSet() || $p->isPrivateSet() : $p->isReadOnly()) ? $p->class : 'stdClass';
-                        $properties[$c][$n] = $v;
-                    }
+                    $properties = $arrayValue;
+                    goto prepare_value;
                 }
-
-                goto prepare_value;
-            }
-
-            $sleep = null;
-            $proto = Registry::$prototypes[$class];
-
-            if (($value instanceof \ArrayIterator || $value instanceof \ArrayObject) && null !== $proto) {
+            } elseif (($value instanceof \ArrayIterator || $value instanceof \ArrayObject) && null !== $proto) {
                 // ArrayIterator and ArrayObject need special care because their "flags"
                 // option changes the behavior of the (array) casting operator.
                 [$arrayValue, $properties] = self::getArrayObjectProperties($value, $proto);
@@ -118,9 +108,7 @@ public static function prepare($values, $objectsPool, &$refsPool, &$objectsCount
                 }
                 $properties = ['SplObjectStorage' => ["\0" => $properties]];
                 $arrayValue = (array) $value;
-            } elseif ($value instanceof \Serializable
-                || $value instanceof \__PHP_Incomplete_Class
-            ) {
+            } elseif ($value instanceof \Serializable || $value instanceof \__PHP_Incomplete_Class) {
                 ++$objectsCount;
                 $objectsPool[$value] = [$id = \count($objectsPool), serialize($value), [], 0];
                 $value = new Reference($id);
@@ -144,16 +132,15 @@ public static function prepare($values, $objectsPool, &$refsPool, &$objectsCount
                 $i = 0;
                 $n = (string) $name;
                 if ('' === $n || "\0" !== $n[0]) {
-                    $p = $reflector->hasProperty($n) ? $reflector->getProperty($n) : null;
-                    $c = $p && (\PHP_VERSION_ID >= 80400 ? $p->isProtectedSet() || $p->isPrivateSet() : $p->isReadOnly()) ? $p->class : 'stdClass';
+                    $parent = $reflector;
+                    do {
+                        $p = $parent->hasProperty($n) ? $parent->getProperty($n) : null;
+                    } while (!$p && $parent = $parent->getParentClass());
+
+                    $c = $p && (!$p->isPublic() || (\PHP_VERSION_ID >= 80400 ? $p->isProtectedSet() || $p->isPrivateSet() : $p->isReadOnly())) ? $p->class : 'stdClass';
                 } elseif ('*' === $n[1]) {
                     $n = substr($n, 3);
                     $c = $reflector->getProperty($n)->class;
-                    if ('Error' === $c) {
-                        $c = 'TypeError';
-                    } elseif ('Exception' === $c) {
-                        $c = 'ErrorException';
-                    }
                 } else {
                     $i = strpos($n, "\0", 2);
                     $c = substr($n, 1, $i - 1);
@@ -166,8 +153,14 @@ public static function prepare($values, $objectsPool, &$refsPool, &$objectsCount
                     }
                     unset($sleep[$name], $sleep[$n]);
                 }
-                if (!\array_key_exists($name, $proto) || $proto[$name] !== $v || "\x00Error\x00trace" === $name || "\x00Exception\x00trace" === $name) {
+                if ("\x00Error\x00trace" === $name || "\x00Exception\x00trace" === $name) {
                     $properties[$c][$n] = $v;
+                } elseif (!\array_key_exists($name, $proto) || $proto[$name] !== $v) {
+                    $properties[match ($c) {
+                        'Error' => 'TypeError',
+                        'Exception' => 'ErrorException',
+                        default => $c,
+                    }][$n] = $v;
                 }
             }
             if ($sleep) {
diff --git a/src/Symfony/Component/VarExporter/Tests/Fixtures/__serialize-but-no-__unserialize.php b/src/Symfony/Component/VarExporter/Tests/Fixtures/__serialize-but-no-__unserialize.php
@@ -6,11 +6,21 @@
     ],
     null,
     [
-        'stdClass' => [
+        'Symfony\\Component\\VarExporter\\Tests\\ParentOf__SerializeButNo__Unserialize' => [
             'foo' => [
+                'foo',
+            ],
+        ],
+        'stdClass' => [
+            'baz' => [
                 'ccc',
             ],
         ],
+        'Symfony\\Component\\VarExporter\\Tests\\__SerializeButNo__Unserialize' => [
+            'bar' => [
+                'ddd',
+            ],
+        ],
     ],
     $o[0],
     []
diff --git a/src/Symfony/Component/VarExporter/Tests/VarExporterTest.php b/src/Symfony/Component/VarExporter/Tests/VarExporterTest.php
@@ -464,19 +464,33 @@ public function __unserialize(array $data): void
     }
 }
 
-class __SerializeButNo__Unserialize
+class ParentOf__SerializeButNo__Unserialize
 {
-    public $foo;
+    private $foo = 'foo';
+
+    public function getFoo()
+    {
+        return $this->foo;
+    }
+}
+
+class __SerializeButNo__Unserialize extends ParentOf__SerializeButNo__Unserialize
+{
+    public $baz;
+    private $bar;
 
     public function __construct()
     {
-        $this->foo = 'ccc';
+        $this->baz = 'ccc';
+        $this->bar = 'ddd';
     }
 
     public function __serialize(): array
     {
         return [
-            'foo' => $this->foo,
+            'foo' => $this->getFoo(),
+            'baz' => $this->baz,
+            'bar' => $this->bar,
         ];
     }
 }

Original file line number	Diff line number	Diff line change
`@@ -214,7 +214,7 @@ public function testClassNoAutoMapping()`
`214`	`214`
`215`	`215`	`/** @var PropertyMetadata[] $autoMappingExplicitlyEnabledMetadata */`
`216`	`216`	`$autoMappingExplicitlyEnabledMetadata = $classMetadata->getPropertyMetadata('autoMappingExplicitlyEnabled');`
`217`		`- $this->assertCount(1, $autoMappingExplicitlyEnabledMetadata[0]->constraints);`
	`217`	`+ $this->assertCount(1, $autoMappingExplicitlyEnabledMetadata[0]->getConstraints());`
`218`	`218`	`$this->assertSame(AutoMappingStrategy::ENABLED, $autoMappingExplicitlyEnabledMetadata[0]->getAutoMappingStrategy());`
`219`	`219`	`}`
`220`	`220`	`}`
Original file line number	Diff line number	Diff line change
`@@ -42,8 +42,8 @@ public function test2Dot5ValidationApi()`
`42`	`42`	`$this->assertCount(1, $metadata->getConstraints());`
`43`	`43`	`$this->assertInstanceOf(FormConstraint::class, $metadata->getConstraints()[0]);`
`44`	`44`
`45`		`- $this->assertSame(CascadingStrategy::NONE, $metadata->cascadingStrategy);`
`46`		`- $this->assertSame(TraversalStrategy::NONE, $metadata->traversalStrategy);`
	`45`	`+ $this->assertSame(CascadingStrategy::NONE, $metadata->getCascadingStrategy());`
	`46`	`+ $this->assertSame(TraversalStrategy::NONE, $metadata->getTraversalStrategy());`
`47`	`47`	`$this->assertCount(0, $metadata->getPropertyMetadata('children'));`
`48`	`48`	`}`
`49`	`49`	`}`
Original file line number	Diff line number	Diff line change
`@@ -464,19 +464,33 @@ public function __unserialize(array $data): void`
`464`	`464`	`}`
`465`	`465`	`}`
`466`	`466`
`467`		`-class __SerializeButNo__Unserialize`
	`467`	`+class ParentOf__SerializeButNo__Unserialize`
`468`	`468`	`{`
`469`		`- public $foo;`
	`469`	`+ private $foo = 'foo';`
	`470`	`+`
	`471`	`+ public function getFoo()`
	`472`	`+ {`
	`473`	`+ return $this->foo;`
	`474`	`+ }`
	`475`	`+}`
	`476`	`+`
	`477`	`+class __SerializeButNo__Unserialize extends ParentOf__SerializeButNo__Unserialize`
	`478`	`+{`
	`479`	`+ public $baz;`
	`480`	`+ private $bar;`
`470`	`481`
`471`	`482`	`public function __construct()`
`472`	`483`	`{`
`473`		`- $this->foo = 'ccc';`
	`484`	`+ $this->baz = 'ccc';`
	`485`	`+ $this->bar = 'ddd';`
`474`	`486`	`}`
`475`	`487`
`476`	`488`	`public function __serialize(): array`
`477`	`489`	`{`
`478`	`490`	`return [`
`479`		`- 'foo' => $this->foo,`
	`491`	`+ 'foo' => $this->getFoo(),`
	`492`	`+ 'baz' => $this->baz,`
	`493`	`+ 'bar' => $this->bar,`
`480`	`494`	`];`
`481`	`495`	`}`
`482`	`496`	`}`