-
-
Notifications
You must be signed in to change notification settings - Fork 9.7k
Closed
Description
Symfony version(s) affected
5.4 & others
Description
Some production setups set disable_functions
to include var_dump
(and exec
, shell_exec
, phpinfo
, etc) for security purposes. This means that var_dump()
may not be always be callable. This becomes relevant here:
symfony/src/Symfony/Component/HttpClient/HttpClientTrait.php
Lines 123 to 126 in 2633877
// Validate on_progress | |
if (!\is_callable($onProgress = $options['on_progress'] ?? 'var_dump')) { | |
throw new InvalidArgumentException(sprintf('Option "on_progress" must be callable, "%s" given.', get_debug_type($onProgress))); | |
} |
The most common case is that on_progress
is not set, so is_callable('var_dump')
is the most common pattern.
This is a problem from PHP 8.0+ because the behaviour changed for is_callable('var_dump')
when the function is disabled.
How to reproduce
$ # PHP 7.4
$ php -d'disable_functions=var_dump' -r 'var_export(is_callable("var_dump"));'
true
$ # PHP 8.0
$ php -d'disable_functions=var_dump' -r 'var_export(is_callable("var_dump"));'
false
Possible Solution
Perhaps switch var_dump
to something innocuous like is_int
?
Additional Context
No response
ro0NL