Merge branch '2.8' into 3.4

* 2.8:
  [SecurityBundle] Backport test
  [Security] fix merge of 2.7 into 2.8 + add test case
  backport regression test from 3.4
  Fix misspelling variable
  [DI] minor: use a strict comparision in setDecoratedService
  Follow-on to #25825: Fix edge case in getParameterOption.
  keep the context when validating forms

Author: xabbuh

Input/ArgvInput.php

@@ -282,7 +282,11 @@ public function hasParameterOption($values, $onlyParams = false)
                 return false;
             }
             foreach ($values as $value) {
-                if ($token === $value || 0 === strpos($token, $value.'=')) {
+                // Options with values:
+                //   For long options, test for '--option=' at beginning
+                //   For short options, test for '-o' at beginning
+                $leading = 0 === strpos($value, '--') ? $value.'=' : $value;
+                if ($token === $value || 0 === strpos($token, $leading)) {
                     return true;
                 }
             }
@@ -306,13 +310,16 @@ public function getParameterOption($values, $default = false, $onlyParams = fals
             }
 
             foreach ($values as $value) {
-                if ($token === $value || 0 === strpos($token, $value.'=')) {
-                    if (false !== $pos = strpos($token, '=')) {
-                        return substr($token, $pos + 1);
-                    }
-
+                if ($token === $value) {
                     return array_shift($tokens);
                 }
+                // Options with values:
+                //   For long options, test for '--option=' at beginning
+                //   For short options, test for '-o' at beginning
+                $leading = 0 === strpos($value, '--') ? $value.'=' : $value;
+                if (0 === strpos($token, $leading)) {
+                    return substr($token, strlen($leading));
+                }
             }
         }
 

Input/InputInterface.php

@@ -33,6 +33,8 @@ public function getFirstArgument();
      *
      * This method is to be used to introspect the input parameters
      * before they have been validated. It must be used carefully.
+     * Does not necessarily return the correct result for short options
+     * when multiple flags are combined in the same option.
      *
      * @param string|array $values     The values to look for in the raw parameters (can be an array)
      * @param bool         $onlyParams Only check real parameters, skip those following an end of options (--) signal
@@ -46,6 +48,8 @@ public function hasParameterOption($values, $onlyParams = false);
      *
      * This method is to be used to introspect the input parameters
      * before they have been validated. It must be used carefully.
+     * Does not necessarily return the correct result for short options
+     * when multiple flags are combined in the same option.
      *
      * @param string|array $values     The value(s) to look for in the raw parameters (can be an array)
      * @param mixed        $default    The default value to return if no result is found

Tests/Input/ArgvInputTest.php

@@ -314,6 +314,10 @@ public function testHasParameterOption()
         $input = new ArgvInput(array('cli.php', '-f', 'foo'));
         $this->assertTrue($input->hasParameterOption('-f'), '->hasParameterOption() returns true if the given short option is in the raw input');
 
+        $input = new ArgvInput(array('cli.php', '-etest'));
+        $this->assertTrue($input->hasParameterOption('-e'), '->hasParameterOption() returns true if the given short option is in the raw input');
+        $this->assertFalse($input->hasParameterOption('-s'), '->hasParameterOption() returns true if the given short option is in the raw input');
+
         $input = new ArgvInput(array('cli.php', '--foo', 'foo'));
         $this->assertTrue($input->hasParameterOption('--foo'), '->hasParameterOption() returns true if the given short option is in the raw input');
 
@@ -339,6 +343,33 @@ public function testHasParameterOptionOnlyOptions()
         $this->assertFalse($input->hasParameterOption('--foo', true), '->hasParameterOption() returns false if the given option is in the raw input but after an end of options signal');
     }
 
+    public function testHasParameterOptionEdgeCasesAndLimitations()
+    {
+        $input = new ArgvInput(array('cli.php', '-fh'));
+        // hasParameterOption does not know if the previous short option, -f,
+        // takes a value or not. If -f takes a value, then -fh does NOT include
+        // -h; Otherwise it does. Since we do not know which short options take
+        // values, hasParameterOption does not support this use-case.
+        $this->assertFalse($input->hasParameterOption('-h'), '->hasParameterOption() returns true if the given short option is in the raw input');
+        // hasParameterOption does detect that `-fh` contains `-f`, since
+        // `-f` is the first short option in the set.
+        $this->assertTrue($input->hasParameterOption('-f'), '->hasParameterOption() returns true if the given short option is in the raw input');
+        // The test below happens to pass, although it might make more sense
+        // to disallow it, and require the use of
+        // $input->hasParameterOption('-f') && $input->hasParameterOption('-h')
+        // instead.
+        $this->assertTrue($input->hasParameterOption('-fh'), '->hasParameterOption() returns true if the given short option is in the raw input');
+        // In theory, if -fh is supported, then -hf should also work.
+        // However, this is not supported.
+        $this->assertFalse($input->hasParameterOption('-hf'), '->hasParameterOption() returns true if the given short option is in the raw input');
+
+        $input = new ArgvInput(array('cli.php', '-f', '-h'));
+        // If hasParameterOption('-fh') is supported for 'cli.php -fh', then
+        // one might also expect that it should also be supported for
+        // 'cli.php -f -h'. However, this is not supported.
+        $this->assertFalse($input->hasParameterOption('-fh'), '->hasParameterOption() returns true if the given short option is in the raw input');
+    }
+
     public function testToString()
     {
         $input = new ArgvInput(array('cli.php', '-f', 'foo'));