Skip to content

Commit c8655fe

Browse files
fabpotfabpot
committed
[Security] made code easier to understand, added some missing unit tests
1 parent b9a76a6 commit c8655fe

File tree

1 file changed

+58
-75
lines changed

1 file changed

+58
-75
lines changed

‎Firewall/ExceptionListener.php

Lines changed: 58 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -81,100 +81,83 @@ public function onKernelException(GetResponseForExceptionEvent $event)
8181
$event->getDispatcher()->removeListener(KernelEvents::EXCEPTION, array($this, 'onKernelException'));
8282

8383
$exception = $event->getException();
84-
$request = $event->getRequest();
85-
86-
while (null !== $exception) {
84+
do {
8785
if ($exception instanceof AuthenticationException) {
88-
if (null !== $this->logger) {
89-
$this->logger->info(sprintf('Authentication exception occurred; redirecting to authentication entry point (%s)', $exception->getMessage()));
90-
}
91-
92-
try {
93-
$response = $this->startAuthentication($request, $exception);
94-
95-
break;
96-
} catch (\Exception $e) {
97-
$event->setException($e);
98-
99-
return;
100-
}
86+
return $this->handleAuthenticationException($event, $exception);
87+
} elseif ($exception instanceof AccessDeniedException) {
88+
return $this->handleAccessDeniedException($event, $exception);
89+
} elseif ($exception instanceof LogoutException) {
90+
return $this->handleLogoutException($event, $exception);
10191
}
92+
} while (null !== $exception = $exception->getPrevious());
93+
}
10294

103-
if ($exception instanceof AccessDeniedException) {
104-
$event->setException(new AccessDeniedHttpException($exception->getMessage(), $exception));
105-
106-
$token = $this->context->getToken();
107-
if (!$this->authenticationTrustResolver->isFullFledged($token)) {
108-
if (null !== $this->logger) {
109-
$this->logger->debug(sprintf('Access is denied (user is not fully authenticated) by "%s" at line %s; redirecting to authentication entry point', $exception->getFile(), $exception->getLine()));
110-
}
111-
112-
try {
113-
$insufficientAuthenticationException = new InsufficientAuthenticationException('Full authentication is required to access this resource.', 0, $exception);
114-
$insufficientAuthenticationException->setToken($token);
115-
$response = $this->startAuthentication($request, $insufficientAuthenticationException);
116-
117-
break;
118-
} catch (\Exception $e) {
119-
$event->setException($e);
120-
121-
return;
122-
}
123-
} else {
124-
if (null !== $this->logger) {
125-
$this->logger->debug(sprintf('Access is denied (and user is neither anonymous, nor remember-me) by "%s" at line %s', $exception->getFile(), $exception->getLine()));
126-
}
127-
128-
try {
129-
if (null !== $this->accessDeniedHandler) {
130-
$response = $this->accessDeniedHandler->handle($request, $exception);
131-
132-
if (!$response instanceof Response) {
133-
return;
134-
}
95+
private function handleAuthenticationException(GetResponseForExceptionEvent $event, AuthenticationException $exception)
96+
{
97+
if (null !== $this->logger) {
98+
$this->logger->info(sprintf('Authentication exception occurred; redirecting to authentication entry point (%s)', $exception->getMessage()));
99+
}
135100

136-
break;
137-
}
101+
try {
102+
$event->setResponse($this->startAuthentication($event->getRequest(), $exception));
103+
} catch (\Exception $e) {
104+
$event->setException($e);
105+
}
106+
}
138107

139-
if (null !== $this->errorPage) {
140-
$subRequest = $this->httpUtils->createRequest($request, $this->errorPage);
141-
$subRequest->attributes->set(SecurityContextInterface::ACCESS_DENIED_ERROR, $exception);
108+
private function handleAccessDeniedException(GetResponseForExceptionEvent $event, AccessDeniedException $exception)
109+
{
110+
$event->setException(new AccessDeniedHttpException($exception->getMessage(), $exception));
142111

143-
$response = $event->getKernel()->handle($subRequest, HttpKernelInterface::SUB_REQUEST, true);
112+
$token = $this->context->getToken();
113+
if (!$this->authenticationTrustResolver->isFullFledged($token)) {
114+
if (null !== $this->logger) {
115+
$this->logger->debug(sprintf('Access is denied (user is not fully authenticated) by "%s" at line %s; redirecting to authentication entry point', $exception->getFile(), $exception->getLine()));
116+
}
144117

145-
break;
146-
}
118+
try {
119+
$insufficientAuthenticationException = new InsufficientAuthenticationException('Full authentication is required to access this resource.', 0, $exception);
120+
$insufficientAuthenticationException->setToken($token);
147121

148-
return;
122+
$event->setResponse($this->startAuthentication($event->getRequest(), $insufficientAuthenticationException));
123+
} catch (\Exception $e) {
124+
$event->setException($e);
125+
}
149126

150-
} catch (\Exception $e) {
151-
if (null !== $this->logger) {
152-
$this->logger->error(sprintf('Exception thrown when handling an exception (%s: %s)', get_class($e), $e->getMessage()));
153-
}
127+
return;
128+
}
154129

155-
$event->setException(new \RuntimeException('Exception thrown when handling an exception.', 0, $e));
130+
if (null !== $this->logger) {
131+
$this->logger->debug(sprintf('Access is denied (and user is neither anonymous, nor remember-me) by "%s" at line %s', $exception->getFile(), $exception->getLine()));
132+
}
156133

157-
return;
158-
}
159-
}
160-
}
134+
try {
135+
if (null !== $this->accessDeniedHandler) {
136+
$response = $this->accessDeniedHandler->handle($event->getRequest(), $exception);
161137

162-
if ($exception instanceof LogoutException) {
163-
if (null !== $this->logger) {
164-
$this->logger->info(sprintf('Logout exception occurred; wrapping with AccessDeniedHttpException (%s)', $exception->getMessage()));
138+
if ($response instanceof Response) {
139+
$event->setResponse($response);
165140
}
141+
} elseif (null !== $this->errorPage) {
142+
$subRequest = $this->httpUtils->createRequest($event->getRequest(), $this->errorPage);
143+
$subRequest->attributes->set(SecurityContextInterface::ACCESS_DENIED_ERROR, $exception);
166144

167-
return;
145+
$event->setResponse($event->getKernel()->handle($subRequest, HttpKernelInterface::SUB_REQUEST, true));
168146
}
169-
170-
if (null === $exception->getPrevious()) {
171-
return;
147+
} catch (\Exception $e) {
148+
if (null !== $this->logger) {
149+
$this->logger->error(sprintf('Exception thrown when handling an exception (%s: %s)', get_class($e), $e->getMessage()));
172150
}
173151

174-
$exception = $exception->getPrevious();
152+
$event->setException(new \RuntimeException('Exception thrown when handling an exception.', 0, $e));
175153
}
154+
}
176155

177-
$event->setResponse($response);
156+
private function handleLogoutException(GetResponseForExceptionEvent $event, LogoutException $exception)
157+
{
158+
if (null !== $this->logger) {
159+
$this->logger->info(sprintf('Logout exception occurred; wrapping with AccessDeniedHttpException (%s)', $exception->getMessage()));
160+
}
178161
}
179162

180163
/**

0 commit comments

Comments
 (0)