json serializer more robust

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
CycloneDX · Oct 8, 2022 · 1d2770d · 1d2770d
1 parent fe7567d
commit 1d2770d
Show file tree

Hide file tree

Showing 4 changed files with 47 additions and 11 deletions.
diff --git a/src/Core/Serialization/BaseSerializer.php b/src/Core/Serialization/BaseSerializer.php
@@ -76,7 +76,7 @@ private function normalize(BOM $bom)
      *
      * @SuppressWarnings(PHPMD.BooleanArgumentFlag)
      */
-    final public function serialize(Bom $bom, bool $prettyPrint = false): string
+    final public function serialize(Bom $bom, ?bool $prettyPrint = null): string
     {
         return $this->realSerialize(
             $this->normalize($bom),
@@ -102,5 +102,5 @@ abstract protected function realNormalize(Bom $bom);
      *
      * @SuppressWarnings(PHPMD.BooleanArgumentFlag)
      */
-    abstract protected function realSerialize($normalizedBom, bool $pretty): string;
+    abstract protected function realSerialize($normalizedBom, ?bool $pretty): string;
 }
diff --git a/src/Core/Serialization/JsonSerializer.php b/src/Core/Serialization/JsonSerializer.php
@@ -32,6 +32,8 @@
  * @psalm-type TNormalizedBom=array
  *
  * @template-extends BaseSerializer<TNormalizedBom>
+ *
+ * @SuppressWarnings(PHPMD.ConstantNamingConventions)
  */
 class JsonSerializer extends BaseSerializer
 {
@@ -49,28 +51,62 @@ class JsonSerializer extends BaseSerializer
         Version::v1dot4 => 'http://cyclonedx.org/schema/bom-1.4.schema.json',
     ];
 
+    /**
+     * List of allowed options for $jsonEncodeFlags.
+     * Some flags will break the output...
+     *
+     * Bitmask consisting of JSON_*.
+     *
+     * @see https://www.php.net/manual/en/json.constants.php
+     */
+    private const JsonEncodeFlagsAllowedOptions = 0
+        | \JSON_HEX_TAG
+        | \JSON_HEX_AMP
+        | \JSON_HEX_APOS
+        | \JSON_HEX_QUOT
+        | \JSON_PRETTY_PRINT
+        | \JSON_UNESCAPED_SLASHES
+        | \JSON_UNESCAPED_UNICODE
+    ;
+
+    /**
+     * List of mandatory options for $jsonEncodeFlags.
+     *
+     * Bitmask consisting of JSON_*.
+     *
+     * @see https://www.php.net/manual/en/json.constants.php
+     */
+    private const JsonEncodeFlagsDefaultOptions = 0
+        | \JSON_UNESCAPED_SLASHES // urls become shorter
+    ;
+
     /** @readonly */
     private JSON\NormalizerFactory $normalizerFactory;
 
     /**
+     * Flags for {@see json_encode}.
+     *
      * Bitmask consisting of JSON_*.
      *
+     * @see https://www.php.net/manual/en/json.constants.php
+     *
      * @readonly
      */
     private int $jsonEncodeFlags = 0
+        // These defaults are required to have valid output.
         | \JSON_THROW_ON_ERROR // prevent unexpected data
         | \JSON_PRESERVE_ZERO_FRACTION // float/double not converted to int
     ;
 
     /**
-     * @param int $jsonEncodeFlags Bitmask consisting of JSON_*
+     * @param int $jsonEncodeFlags Bitmask consisting of JSON_*. see {@see JsonEncodeFlagsAllowedOptions}
      */
     public function __construct(
         JSON\NormalizerFactory $normalizerFactory,
-        int $jsonEncodeFlags = \JSON_UNESCAPED_SLASHES // urls become shorter
+        int $jsonEncodeFlags = self::JsonEncodeFlagsDefaultOptions
     ) {
         $this->normalizerFactory = $normalizerFactory;
-        $this->jsonEncodeFlags |= $jsonEncodeFlags;
+        $this->jsonEncodeFlags |= $jsonEncodeFlags & self::JsonEncodeFlagsAllowedOptions;
     }
 
     /**
@@ -92,7 +128,7 @@ protected function realNormalize(Bom $bom): array
      *
      * @psalm-return non-empty-string
      */
-    protected function realSerialize($normalizedBom, bool $pretty): string
+    protected function realSerialize($normalizedBom, ?bool $pretty): string
     {
         /** @var string|null $schema */
         $schema = self::SCHEMA[$this->normalizerFactory->getSpec()->getVersion()] ?? null;
@@ -101,7 +137,7 @@ protected function realSerialize($normalizedBom, bool $pretty): string
         }
 
         $jsonEncodeFlags = $this->jsonEncodeFlags;
-        if ($pretty) {
+        if (true === $pretty) {
             $jsonEncodeFlags |= \JSON_PRETTY_PRINT;
         }
 

diff --git a/src/Core/Serialization/Serializer.php b/src/Core/Serialization/Serializer.php
@@ -32,11 +32,11 @@ interface Serializer
      * Serialize a {@see Bom} to {@see string}.
      *
      * @param Bom  $bom         the bom to serialize
-     * @param bool $prettyPrint whether to beatify the resulting string
+     * @param bool $prettyPrint whether to beatify the resulting string. A `null` value means no preference.
      *
      * @throws Exception
      *
      * @SuppressWarnings(PHPMD.BooleanArgumentFlag)
      */
-    public function serialize(Bom $bom, bool $prettyPrint = false): string;
+    public function serialize(Bom $bom, ?bool $prettyPrint = null): string;
 }
diff --git a/src/Core/Serialization/XmlSerializer.php b/src/Core/Serialization/XmlSerializer.php
@@ -74,7 +74,7 @@ protected function realNormalize(Bom $bom): DOMElement
      *
      * @psalm-return non-empty-string
      */
-    protected function realSerialize($normalizedBom, bool $pretty): string
+    protected function realSerialize($normalizedBom, ?bool $pretty): string
     {
         $document = new DOMDocument($this->xmlVersion, $this->xmlEncoding);
         $document->appendChild(
@@ -84,7 +84,7 @@ protected function realSerialize($normalizedBom, bool $pretty): string
             )
         );
 
-        if ($pretty) {
+        if (true === $pretty) {
             $document->formatOutput = true;
         }