Merge branch '2.3' into 2.7v2.7.13

* 2.3:
  limited the maximum length of a submitted username

5 files changed, 90 insertions, 0 deletions

diff --git a/Core/Security.php b/Core/Security.php
index 14d32f8..84cc77d 100644
--- a/Core/Security.php
+++ b/Core/Security.php
@@ -21,4 +21,5 @@ final class Security
     const ACCESS_DENIED_ERROR = '_security.403_error';
     const AUTHENTICATION_ERROR = '_security.last_error';
     const LAST_USERNAME = '_security.last_username';
+    const MAX_USERNAME_LENGTH = 4096;
 }
diff --git a/Core/SecurityContextInterface.php b/Core/SecurityContextInterface.php
index 2a06ca4..73edd23 100644
--- a/Core/SecurityContextInterface.php
+++ b/Core/SecurityContextInterface.php
@@ -26,4 +26,5 @@ interface SecurityContextInterface extends TokenStorageInterface, AuthorizationC
     const ACCESS_DENIED_ERROR = Security::ACCESS_DENIED_ERROR;
     const AUTHENTICATION_ERROR = Security::AUTHENTICATION_ERROR;
     const LAST_USERNAME = Security::LAST_USERNAME;
+    const MAX_USERNAME_LENGTH = Security::MAX_USERNAME_LENGTH;
 }
diff --git a/Http/Firewall/SimpleFormAuthenticationListener.php b/Http/Firewall/SimpleFormAuthenticationListener.php
index 4733b6a..8123e0e 100644
--- a/Http/Firewall/SimpleFormAuthenticationListener.php
+++ b/Http/Firewall/SimpleFormAuthenticationListener.php
@@ -24,6 +24,7 @@ use Symfony\Component\Security\Http\Authentication\AuthenticationSuccessHandlerI
 use Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface;
 use Symfony\Component\Security\Core\Authentication\SimpleFormAuthenticatorInterface;
 use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
+use Symfony\Component\Security\Core\Exception\BadCredentialsException;
 use Symfony\Component\Security\Core\Security;
 use Symfony\Component\Security\Http\HttpUtils;
 use Symfony\Component\Security\Http\Session\SessionAuthenticationStrategyInterface;
@@ -116,6 +117,10 @@ class SimpleFormAuthenticationListener extends AbstractAuthenticationListener
             $password = $request->get($this->options['password_parameter'], null, true);
         }
 
+        if (strlen($username) > Security::MAX_USERNAME_LENGTH) {
+            throw new BadCredentialsException('Invalid username.');
+        }
+
         $request->getSession()->set(Security::LAST_USERNAME, $username);
 
         $token = $this->simpleAuthenticator->createToken($request, $username, $password, $this->providerKey);
diff --git a/Http/Firewall/UsernamePasswordFormAuthenticationListener.php b/Http/Firewall/UsernamePasswordFormAuthenticationListener.php
index 07ab85a..ba4329b 100644
--- a/Http/Firewall/UsernamePasswordFormAuthenticationListener.php
+++ b/Http/Firewall/UsernamePasswordFormAuthenticationListener.php
@@ -24,6 +24,7 @@ use Symfony\Component\Security\Http\HttpUtils;
 use Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface;
 use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
 use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
+use Symfony\Component\Security\Core\Exception\BadCredentialsException;
 use Symfony\Component\Security\Core\Exception\InvalidArgumentException;
 use Symfony\Component\Security\Core\Exception\InvalidCsrfTokenException;
 use Symfony\Component\Security\Core\Security;
@@ -91,6 +92,10 @@ class UsernamePasswordFormAuthenticationListener extends AbstractAuthenticationL
             $password = $request->get($this->options['password_parameter'], null, true);
         }
 
+        if (strlen($username) > Security::MAX_USERNAME_LENGTH) {
+            throw new BadCredentialsException('Invalid username.');
+        }
+
         $request->getSession()->set(Security::LAST_USERNAME, $username);
 
         return $this->authenticationManager->authenticate(new UsernamePasswordToken($username, $password, $this->providerKey));
diff --git a/Tests/Http/Firewall/UsernamePasswordFormAuthenticationListenerTest.php b/Tests/Http/Firewall/UsernamePasswordFormAuthenticationListenerTest.php
new file mode 100644
index 0000000..b7c6ab9
--- /dev/null
+++ b/Tests/Http/Firewall/UsernamePasswordFormAuthenticationListenerTest.php
@@ -0,0 +1,78 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Tests\Http\Firewall;
+
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Firewall\UsernamePasswordFormAuthenticationListener;
+use Symfony\Component\Security\Core\SecurityContextInterface;
+
+class UsernamePasswordFormAuthenticationListenerTest extends \PHPUnit_Framework_TestCase
+{
+    /**
+     * @dataProvider getUsernameForLength
+     */
+    public function testHandleWhenUsernameLength($username, $ok)
+    {
+        $request = Request::create('/login_check', 'POST', array('_username' => $username));
+        $request->setSession($this->getMock('Symfony\Component\HttpFoundation\Session\SessionInterface'));
+
+        $httpUtils = $this->getMock('Symfony\Component\Security\Http\HttpUtils');
+        $httpUtils
+            ->expects($this->any())
+            ->method('checkRequestPath')
+            ->will($this->returnValue(true))
+        ;
+
+        $failureHandler = $this->getMock('Symfony\Component\Security\Http\Authentication\AuthenticationFailureHandlerInterface');
+        $failureHandler
+            ->expects($ok ? $this->never() : $this->once())
+            ->method('onAuthenticationFailure')
+            ->will($this->returnValue(new Response()))
+        ;
+
+        $authenticationManager = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\AuthenticationProviderManager')->disableOriginalConstructor()->getMock();
+        $authenticationManager
+            ->expects($ok ? $this->once() : $this->never())
+            ->method('authenticate')
+            ->will($this->returnValue(new Response()))
+        ;
+
+        $listener = new UsernamePasswordFormAuthenticationListener(
+            $this->getMock('Symfony\Component\Security\Core\SecurityContextInterface'),
+            $authenticationManager,
+            $this->getMock('Symfony\Component\Security\Http\Session\SessionAuthenticationStrategyInterface'),
+            $httpUtils,
+            'TheProviderKey',
+            $this->getMock('Symfony\Component\Security\Http\Authentication\AuthenticationSuccessHandlerInterface'),
+            $failureHandler,
+            array('require_previous_session' => false)
+        );
+
+        $event = $this->getMock('Symfony\Component\HttpKernel\Event\GetResponseEvent', array(), array(), '', false);
+        $event
+            ->expects($this->any())
+            ->method('getRequest')
+            ->will($this->returnValue($request))
+        ;
+
+        $listener->handle($event);
+    }
+
+    public function getUsernameForLength()
+    {
+        return array(
+            array(str_repeat('x', SecurityContextInterface::MAX_USERNAME_LENGTH + 1), false),
+            array(str_repeat('x', SecurityContextInterface::MAX_USERNAME_LENGTH - 1), true),
+        );
+    }
+}