Uninitialized properties on readonly classes without constructor

[repli2dev]

Symfony version(s) affected

7.0.2

Description

In the below context I get object with uninitialized fields... If I remove the readonly from class definition it starts to work.

How to reproduce

<?php
declare(strict_types=1);

require_once __DIR__ . '/vendor/autoload.php';

use Symfony\Component\Serializer\Encoder\JsonEncoder;
use Symfony\Component\Serializer\Normalizer\ObjectNormalizer;
use Symfony\Component\Serializer\Serializer;

$encoders = [new JsonEncoder()];
$normalizers = [new ObjectNormalizer()];

$serializer = new Serializer($normalizers, $encoders);

readonly class FirstDTO {
    public int $id;
    public string $name;
}

$data = <<<EOF
{
    "id": 1,
    "name": "John Doe"
}
EOF;

try {
    $object = $serializer->deserialize($data, FirstDTO::class, 'json');
    var_dump($object);
} catch (\Symfony\Component\Serializer\Exception\ExceptionInterface $e) {
    echo $e->getMessage();
}

With

symfony/polyfill-ctype           v1.28.0 Symfony polyfill for ctype functions
symfony/polyfill-intl-grapheme   v1.28.0 Symfony polyfill for intl's grapheme_* functions
symfony/polyfill-intl-normalizer v1.28.0 Symfony polyfill for intl's Normalizer class and related functions
symfony/polyfill-mbstring        v1.28.0 Symfony polyfill for the Mbstring extension
symfony/property-access          v7.0.0  Provides functions to read and write from/to an object or array using a simple string notation
symfony/property-info            v7.0.0  Extracts information about PHP class' properties using metadata of popular sources
symfony/serializer               v7.0.2  Handles serializing and deserializing data structures, including object graphs, into array structures or other formats like XML and JSON.
symfony/string                   v7.0.2  Provides an object-oriented API to strings and deals with bytes, UTF-8 code points and grapheme clusters in a unified way

Possible Solution

No response

Additional Context

No response

[repli2dev]

Ok, it seems that the issue is limited to ObjectNormalizer, if PropertyNormalizer is used it works.

[xabbuh]

Same as #53600?

[repli2dev]

@xabbuh yeah it seems like the same issue yet here it is also displayed without the constructor property promotion case.

[Valmonzo]

deserialize($data, FirstDTO::class, 'json'); var_dump($object); } catch (\Symfony\Component\Serializer\Exception\ExceptionInterface $e) { echo $e->getMessage(); }

In your example, your class FirstDTO is marked as readonly. If I'm not mistaken, the deserialize method may face issues because, without a constructor, the ObjectNormalizer will create an instance of your object and then attempt to assign values to it. However, in this case, properties of your readonly class cannot be modified after the object has been instantiated.
A constructor is the best way there I think.

[repli2dev]

@Valmonzo then why it works if PropertyNormalizer (which also respect strict types and does not do type coersion)?

[Valmonzo]

@repli2dev if i'm not dumb ObjectNormalizer works with PropertyAccessor and PropertyNormalizer works by reflection so it looks like it bypass the readonly on your class, I'm not sure and I won't say stupid thing, I think we should wait for another opinion !

[mtarld]

@repli2dev, as I can see, your class is readonly and without constructor, therefore properties are meant to be uninitialized here.

The PropertyNormalizer is himself using reflection to set properties values, so the fact it succeeds to set readonly properties is a nice side effect.

That's why it isn't an issue here, IMHO.

[repli2dev]

@mtarld Maye there is no bug yet the behaviour is countraintuitive... like the ObjectNormalizer works on DTOs with non-readable (public) property and without constructor...

Basically coming to the Symfony serializer and using the default in docs I have very suboptimal experience (for my use case*) whether the Symfony serializer works... unless I deep dive into details and discovering the PropertyNormalizer.

• Serialize and deserialize constructor less readonly DTO's

[xabbuh]

The behaviour is indeed no bug as @mtarld explained. That's why I am going to close here. But please feel free to submit a PR improving the docs or opening an issue in the docs repository if you think that this can be explained better somehow. Thank you for understanding.