composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-04-26 03:58:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°8017 - Security - dependabot - Symfony's VarDumper vulnerable to un… (#731)

Browse Source 
Upgrade all Symfony components to last security fix (~6.4.0)
This commit is contained in:
Benjamin Dalsass
2025-08-06 08:54:56 +02:00
committed by GitHub
parent 603340b852
commit cdbcd14767
608 changed files with 5020 additions and 3793 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
lib/symfony/framework-bundle/Secrets/SodiumVault.php
View File

@@ -12,6 +12,7 @@
namespace Symfony\Bundle\FrameworkBundle\Secrets;
use Symfony\Component\DependencyInjection\EnvVarLoaderInterface;
use Symfony\Component\String\LazyString;
use Symfony\Component\VarExporter\VarExporter;
/**
@@ -30,7 +31,7 @@ class SodiumVault extends AbstractVault implements EnvVarLoaderInterface
* @param $decryptionKey A string or a stringable object that defines the private key to use to decrypt the vault
* or null to store generated keys in the provided $secretsDir
*/
public function __construct(string $secretsDir, #[\SensitiveParameter] string|\Stringable $decryptionKey = null)
public function __construct(string $secretsDir, #[\SensitiveParameter] string|\Stringable|null $decryptionKey = null)
{
$this->pathPrefix = rtrim(strtr($secretsDir, '/', \DIRECTORY_SEPARATOR), \DIRECTORY_SEPARATOR).\DIRECTORY_SEPARATOR.basename($secretsDir).'.';
$this->decryptionKey = $decryptionKey;
@@ -169,7 +170,14 @@ class SodiumVault extends AbstractVault implements EnvVarLoaderInterface
public function loadEnvVars(): array
{
return $this->list(true);
$envs = [];
$reveal = $this->reveal(...);
foreach ($this->list() as $name => $value) {
$envs[$name] = LazyString::fromCallable($reveal, $name);
}
return $envs;
}
private function loadKeys(): void