orisai / object-mapper

Raw data mapping to validated objects
Mozilla Public License 2.0
10 stars 1 forks source link

Check DefaultProcessor::handleMissingFields() for infinite loops #45

Open mabar opened 1 year ago

mabar commented 1 year ago

Auto-initialization of objects may lead to infinite loops in case of self-references. Needs test for verification.

Metadata-based detection is not possible - even object with all properties required may be still initializable due to before class callback. If no solution is found, feature may be just removed.

Solving it in runtime may not be viable - creating first object in structure and omiting same one deeper in structure is not deterministic behavior.

https://github.com/orisai/object-mapper/blob/29a0d58fcddd5343acca6e30d1209991c58d8da4/src/Processing/DefaultProcessor.php#L428-L442

mabar commented 1 year ago

It causes infinite loops. And fork before class callbacks. Unconditional self reference is simply wrong design.

Unconditional self reference should be forbidden during metadata validation.

Both direct and non-direct (A -> B -> C -> A) self references should be validated. But only MappedObjectRule must be inspected, it is the only case where auto-initialization is used.

use Orisai\ObjectMapper\Attributes\Expect\MappedObjectValue;
use Orisai\ObjectMapper\MappedObject;

final class UnconditionalSelfReferenceVO implements MappedObject
{

    /**
     * @MappedObjectValue(UnconditionalSelfReferenceVO::class)
     */
    public UnconditionalSelfReferenceVO $self;

}