From c00da06b82b8591548f52b4d6aad0faa0985843e Mon Sep 17 00:00:00 2001 From: Jordi Boggiano Date: Thu, 18 Mar 2021 08:44:57 +0100 Subject: [PATCH] [Validator] Avoid triggering the autoloader for user-input values --- Validator/RecursiveContextualValidator.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Validator/RecursiveContextualValidator.php b/Validator/RecursiveContextualValidator.php index 9e743f44a..c816317fb 100644 --- a/Validator/RecursiveContextualValidator.php +++ b/Validator/RecursiveContextualValidator.php @@ -656,8 +656,10 @@ private function validateGenericNode($value, $object, ?string $cacheKey, ?Metada return; } - // If the value is a scalar, pass it anyway, because we want - // a NoSuchMetadataException to be thrown in that case + if (!\is_object($value)) { + throw new NoSuchMetadataException(sprintf('Cannot create metadata for non-objects. Got: "%s".', \gettype($value))); + } + $this->validateObject( $value, $propertyPath,