Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Array to string conversion #1376

Open
enumag opened this issue Dec 7, 2021 · 0 comments
Open

Array to string conversion #1376

enumag opened this issue Dec 7, 2021 · 0 comments

Comments

@enumag
Copy link
Contributor

enumag commented Dec 7, 2021

Q A
Bug report? yes
Feature request? no
BC Break report? no
RFC? no

Recently I found an array to string conversion bug in mhujer/jms-serializer-uuid#14 (fixed here). While investigating the author found out that the same issue exists in serializer itself for DateTimes. We can't assume that $data can be safely converted to string here:

private function parseDateTime($data, array $type, bool $immutable = false): \DateTimeInterface
{
$timezone = !empty($type['params'][1]) ? new \DateTimeZone($type['params'][1]) : $this->defaultTimezone;
$formats = $this->getDeserializationFormats($type);
$formatTried = [];
foreach ($formats as $format) {
if ($immutable) {
$datetime = \DateTimeImmutable::createFromFormat($format, (string) $data, $timezone);
} else {
$datetime = \DateTime::createFromFormat($format, (string) $data, $timezone);
}
if (false !== $datetime) {
if ('U' === $format) {
$datetime = $datetime->setTimezone($timezone);
}
return $datetime;
}
$formatTried[] = $format;
}
throw new RuntimeException(sprintf(
'Invalid datetime "%s", expected one of the format %s.',
$data,
'"' . implode('", "', $formatTried) . '"'
));
}

Other handlers might suffer from this too.

Steps required to reproduce the problem

Send an array value where API expects a DateTime string.

Expected Result

Error that the value is invalid.

Actual Result

Array to string conversion warning.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant