rompetomp / inertia-bundle

Inertia.js server-side adapter for Symfony
MIT License
151 stars 36 forks source link

is_callable check in prop evaluation may try to execute something that's not callable #46

Closed jaydiablo closed 1 year ago

jaydiablo commented 1 year ago

Since #42 landed I noticed a bug in this bundle.

When rendering certain data I ended up getting an ArgumentCountError, and in this specific case it was because PHP's system global function was trying to be called with 0 arguments. This seemed odd because we don't call system anywhere in our code.

It seems that this is due to the is_callable check that was added in #42. In our case, we had a value that was System for an item in an array (not a parent level prop, but an array of data that we were passing to Inertia).

is_callable will accept a string as the first parameter, and if that string is a global function name (which system is, https://www.php.net/system) is_callable will return true and then try to execute that function in the call_user_func that follows (https://github.com/rompetomp/inertia-bundle/blob/master/Service/Inertia.php#L160) which is probably not the intent here.

https://3v4l.org/I9QKY

The previous behavior of checking if the prop was a Closure didn't have this issue. I suspect anyone that has basic string props that happen to match a global PHP function name will also run into this issue of inertia trying to execute PHP functions when the prop itself was just a simple string.

jaydiablo commented 1 year ago

Thanks @cydrickn !