Serializer/PropertyInfo treats list<Type> as Type[] and does not enforce sequential indexes

[Tobion]

Symfony version(s) affected

6.2.3

Description

list<Type> annotation in phpstan and psalm are

Lists are arrays with sequential integer keys starting at 0.

But when annotating an array like this, the deserializer (and I fear also the propertyinfo component) does not distinguish between a list and a generic array (Type[] / array<Type>). It enforces in both cases that the array indexes are integers. But it does not check that the result is an array_is_list in the list case.

So this means that you can actually deserialize a json object with integer keys instead of an actual json array and you will get a deserialized object where the array indexes are not sequential starting at 0.

How to reproduce

• Annotate an array with list<string>
• Try to deserialze a json object with with non-sequential integer keys json_encode([5 => 'foo', 1 => 'bar']) which should fail

Possible Solution

• Better solution: Validate the incoming array with array_is_list so it's not allowed to deserialize a json object into an list
• Worse solution: use array_values at the end to ensure the resulting array is valid according to the annotated type

Additional Context

No response

[stof]

PropertyInfo does not have full support for lists. It only has parser support for the, treating them like array<int, Type> (which is not the same than Type[] btw) so that we don't throw an exception when we don't understand a syntax. Note that phpstan without bleedingEdge mode does exactly the same. Full support for list<Type> will only be enabled in phpstan 2.0.

Full support for lists in the Serializer and PropertyInfo is a new feature to me, not a bugfix.

[carsonbot]

Hey, thanks for your report! There has not been a lot of activity here for a while. Is this bug still relevant? Have you managed to find a workaround?

[carsonbot]

Could I get a reply or should I close this?

[carsonbot]

Hey,

I didn't hear anything so I'm going to close it. Feel free to comment if this is still relevant, I can always reopen!