Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change priority of RequestValidationSubscriber to give more priority to the firewall listeners of Symfony's security bundle #86

Merged
merged 8 commits into from
Mar 20, 2024

Conversation

niels-nijens
Copy link
Member

This PR changes the priority of the RequestValidationSubscriber to give more priority to the firewall listeners of Symfony's security bundle.

The change prevents possibly exposing API internals by prematurely validating the request body on authenticated endpoints.

⚠️ Please note this might be a breaking change when your application depends on the listener priority of this bundle.

Copy link

Code Coverage Report:
2024-03-20 15:20:18

Summary:
Classes: 68.57% (24/35)
Methods: 91.25% (146/160)
Lines: 96.72% (913/944)

Nijens\OpenapiBundle\Controller\CatchAllController
Methods: 100.00% ( 4/ 4) Lines: 100.00% ( 30/ 30)
Nijens\OpenapiBundle\DependencyInjection\Configuration
Methods: 50.00% ( 2/ 4) Lines: 88.99% ( 97/109)
Nijens\OpenapiBundle\DependencyInjection\NijensOpenapiExtension
Methods: 80.00% ( 4/ 5) Lines: 91.43% ( 32/ 35)
Nijens\OpenapiBundle\DependencyInjection\ServiceFactory
Methods: 0.00% ( 0/ 1) Lines: 60.00% ( 3/ 5)
Nijens\OpenapiBundle\Deserialization\ArgumentResolver\DeserializedObjectArgumentResolver
Methods: 60.00% ( 3/ 5) Lines: 90.91% ( 20/ 22)
Nijens\OpenapiBundle\Deserialization\Attribute\DeserializedObject
Methods: ( 0/ 0) Lines: ( 0/ 0)
Nijens\OpenapiBundle\Deserialization\DeserializationContext
Methods: ( 0/ 0) Lines: ( 0/ 0)
Nijens\OpenapiBundle\Deserialization\EventSubscriber\JsonRequestBodyDeserializationSubscriber
Methods: 100.00% ( 3/ 3) Lines: 100.00% ( 20/ 20)
Nijens\OpenapiBundle\EventListener\JsonRequestBodyValidationSubscriber
Methods: 100.00% ( 6/ 6) Lines: 100.00% ( 47/ 47)
Nijens\OpenapiBundle\EventListener\JsonResponseExceptionSubscriber
Methods: 66.67% ( 2/ 3) Lines: 86.67% ( 13/ 15)
Nijens\OpenapiBundle\ExceptionHandling\DeprecatedExceptionToProblemExceptionTransformer
Methods: 66.67% ( 2/ 3) Lines: 93.33% ( 14/ 15)
Nijens\OpenapiBundle\ExceptionHandling\EventSubscriber\ProblemExceptionToJsonResponseSubscriber
Methods: 66.67% ( 2/ 3) Lines: 93.75% ( 15/ 16)
Nijens\OpenapiBundle\ExceptionHandling\EventSubscriber\ThrowableToProblemExceptionSubscriber
Methods: 75.00% ( 3/ 4) Lines: 93.75% ( 15/ 16)
Nijens\OpenapiBundle\ExceptionHandling\Exception\InvalidContentTypeProblemException
Methods: ( 0/ 0) Lines: ( 0/ 0)
Nijens\OpenapiBundle\ExceptionHandling\Exception\InvalidRequestBodyProblemException
Methods: ( 0/ 0) Lines: ( 0/ 0)
Nijens\OpenapiBundle\ExceptionHandling\Exception\InvalidRequestParameterProblemException
Methods: ( 0/ 0) Lines: ( 0/ 0)
Nijens\OpenapiBundle\ExceptionHandling\Exception\InvalidRequestProblemException
Methods: 100.00% ( 5/ 5) Lines: 100.00% ( 12/ 12)
Nijens\OpenapiBundle\ExceptionHandling\Exception\ProblemException
Methods: 100.00% (16/16) Lines: 100.00% ( 55/ 55)
Nijens\OpenapiBundle\ExceptionHandling\Exception\Violation
Methods: 100.00% ( 6/ 6) Lines: 100.00% ( 16/ 16)
Nijens\OpenapiBundle\ExceptionHandling\Normalizer\ProblemExceptionNormalizer
Methods: 66.67% ( 4/ 6) Lines: 84.62% ( 22/ 26)
Nijens\OpenapiBundle\ExceptionHandling\ThrowableToProblemExceptionTransformer
Methods: 100.00% ( 3/ 3) Lines: 100.00% ( 18/ 18)
Nijens\OpenapiBundle\Exception\BadJsonRequestHttpException
Methods: 100.00% ( 1/ 1) Lines: 100.00% ( 5/ 5)
Nijens\OpenapiBundle\Exception\InvalidRequestHttpException
Methods: 100.00% ( 2/ 2) Lines: 100.00% ( 2/ 2)
Nijens\OpenapiBundle\Json\Dereferencer
Methods: 100.00% ( 6/ 6) Lines: 100.00% ( 43/ 43)
Nijens\OpenapiBundle\Json\Exception\InvalidArgumentException
Methods: ( 0/ 0) Lines: ( 0/ 0)
Nijens\OpenapiBundle\Json\Exception\InvalidJsonPointerException
Methods: ( 0/ 0) Lines: ( 0/ 0)
Nijens\OpenapiBundle\Json\Exception\LoaderLoadException
Methods: ( 0/ 0) Lines: ( 0/ 0)
Nijens\OpenapiBundle\Json\JsonPointer
Methods: 100.00% (11/11) Lines: 100.00% ( 39/ 39)
Nijens\OpenapiBundle\Json\Loader\ChainLoader
Methods: 100.00% ( 3/ 3) Lines: 100.00% ( 9/ 9)
Nijens\OpenapiBundle\Json\Loader\JsonLoader
Methods: 100.00% ( 2/ 2) Lines: 100.00% ( 7/ 7)
Nijens\OpenapiBundle\Json\Loader\YamlLoader
Methods: 100.00% ( 2/ 2) Lines: 100.00% ( 4/ 4)
Nijens\OpenapiBundle\Json\Reference
Methods: 100.00% (11/11) Lines: 100.00% ( 24/ 24)
Nijens\OpenapiBundle\Json\SchemaLoader
Methods: 100.00% ( 3/ 3) Lines: 100.00% ( 10/ 10)
Nijens\OpenapiBundle\Json\Schema\Constraint\TypeConstraint
Methods: 100.00% ( 1/ 1) Lines: 100.00% ( 8/ 8)
Nijens\OpenapiBundle\NijensOpenapiBundle
Methods: 50.00% ( 1/ 2) Lines: 77.78% ( 7/ 9)
Nijens\OpenapiBundle\Routing\RouteContext
Methods: ( 0/ 0) Lines: ( 0/ 0)
Nijens\OpenapiBundle\Routing\RouteLoader
Methods: 100.00% (10/10) Lines: 100.00% (111/111)
Nijens\OpenapiBundle\Serialization\SerializationContextBuilder
Methods: 85.71% ( 6/ 7) Lines: 97.87% ( 46/ 47)
Nijens\OpenapiBundle\Service\ExceptionJsonResponseBuilder
Methods: 100.00% ( 2/ 2) Lines: 100.00% ( 16/ 16)
Nijens\OpenapiBundle\Validation\EventSubscriber\RequestValidationSubscriber
Methods: 100.00% ( 4/ 4) Lines: 100.00% ( 13/ 13)
Nijens\OpenapiBundle\Validation\RequestValidator\CompositeRequestValidator
Methods: 100.00% ( 2/ 2) Lines: 100.00% ( 6/ 6)
Nijens\OpenapiBundle\Validation\RequestValidator\RequestBodyValidator
Methods: 100.00% ( 7/ 7) Lines: 100.00% ( 64/ 64)
Nijens\OpenapiBundle\Validation\RequestValidator\RequestContentTypeValidator
Methods: 100.00% ( 3/ 3) Lines: 100.00% ( 26/ 26)
Nijens\OpenapiBundle\Validation\RequestValidator\RequestParameterValidator
Methods: 100.00% ( 4/ 4) Lines: 100.00% ( 42/ 42)
Nijens\OpenapiBundle\Validation\ValidationContext
Methods: ( 0/ 0) Lines: ( 0/ 0)

@niels-nijens niels-nijens merged commit 2faf0f2 into nijens:main Mar 20, 2024
40 checks passed
@niels-nijens niels-nijens deleted the security-listener-priority branch March 20, 2024 15:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant