PSR-6 cache issue with RecursiveContextualValidator.php

[ahungry]

In the RecursiveContextualValidator.php file, it makes the class metadata map, with propertyName as a key for the caching.

This has a bad bug when a key (property name) is re-used between nested class instances, such that the value of the key is included in the cache name - however, if multiple entities / nested object instances have the same key/value pairs, this causes a collision and gives an error about the class metadata map expecting an object, but a boolean being returned.

The other portion of this bug is that the value used as part of the cache key is not escaped in anyway, and it is very likely and possible that the value has 'illegal' cache key characters (parenthesis etc.).

This is not extensively tested, but seems to fix for our use case (adding something similar to this after line 563 in Symfony/Component/Validator/Validator/RecursiveContextualValidator.php):

            // Need to escape this and ensure uniqueness.                                                                                                                                              
            $propertyName = base64_encode($propertyPath . '.' . $propertyName);

Edit: This is with Symfony 3.1.5+ that seems to have introduced the issue

[ahungry]

I think this is primarily an issue when @Assert\Valid is used on non-object properties (or mixed case ones that could be a non-object or an object).

This is a minimum testing file to illustrate the exception thrown (the test used here will not pass):

<?php

use Symfony\Component\Validator\Constraints as Assert;
use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;

class Parent20685
{
    /**                                                                                                                                                                                                
     * @Assert\Valid                                                                                                                                                                                   
     */
    public $child20685A;

    /**                                                                                                                                                                                                
     * @Assert\Valid                                                                                                                                                                                   
     */
    public $child20685B;
}

class Child20685A
{
    /**                                                                                                                                                                                                
     * @Assert\Valid                                                                                                                                                                                   
     * @Assert\NotBlank                                                                                                                                                                                
     */
    public $name;
}

class Child20685B
{
    /**                                                                                                                                                                                                
     * @Assert\Valid                                                                                                                                                                                   
     * @Assert\NotBlank                                                                                                                                                                                
     */
    public $name;
}

class Validator206858Test extends WebTestCase
{
    public function test206858()
    {
        static::bootKernel();
	$container = static::$kernel->getContainer();
	$validator = $container->get('validator');

        $parent = new Parent20685();
	$childA = new Child20685A();
        $childB = new Child20685B();

        $childA->name = false;
        $childB->name = 'fake';

        $parent->child20685A = [$childA];
        $parent->child20685B = [$childB];

        $validator->validate($parent, null, ['Default']);

        $this->assertEquals(1, 1);
    }
}

With the change I posted in the initial post, this test will pass fine without an error.

The test also passes on sub 3.1.5 versions (3.0.* and below seem to have no problems with using @Assert\Valid on object properties that may or may not be objects themselves).

[ahungry]

Also - in actual program usage, with debug set to true in the second AppKernel parameter, this does not result in an exception being thrown, but without (debug set to false) it does, which seems odd.

[nicolas-grekas]

ping @dunglas I guess

[dunglas]

@ahungry can you confirm that #20745 fix your problem please?

[ahungry]

Looks good, thanks!