Skip to content

[Yaml] Throw a ParseException on keys starting with a NUL byte when parsing mappings as objects - #66830

Merged
nicolas-grekas merged 1 commit into
symfony:6.4from
lazerg:fix/issue-66829-yaml-nul-key-object-map
Oct 12, 2026
Merged

nicolas-grekas merged 1 commit into
symfony:6.4from
lazerg:fix/issue-66829-yaml-nul-key-object-map

Conversation

@lazerg

@lazerg lazerg commented Oct 12, 2026

Copy link
Copy Markdown
Contributor
Q A
Branch? 6.4
Bug fix? yes
New feature? no
Deprecations? no
Issues Fix #66829
License MIT

With Yaml::PARSE_OBJECT_FOR_MAP, a mapping key that starts with a NUL byte crashes the block parser with a PHP \Error, because PHP does not allow such property names on stdClass. Code that catches ParseException does not catch it.

Yaml::parse("'\0': 1\n", Yaml::PARSE_OBJECT_FOR_MAP);
// Before: Error: Cannot access property starting with "\0"
// After: ParseException: Mapping keys starting with a NUL byte are not supported with the "Yaml::PARSE_OBJECT_FOR_MAP" flag at line 1 (near "'\0': 1").

The inline parser does not crash, because it uses an (object) cast. But the cast gives a broken object: { "\0": 1 } gets an inaccessible property, and { "\0*\0x": 1 } gets a protected property named x. So both parsers now throw the same ParseException when they read such a key with the flag. Keys with a NUL byte in other positions ("a\0b") are valid property names and still work. Without the flag, nothing changes.

Tests: ParserTest::testKeyStartingWithNulByteThrowsParseExceptionWhenMappingsAreParsedAsObjects and InlineTest::testParseKeyStartingWithNulByteWithMapObjectsThrowsParseException fail without the fix. The Yaml test suite passes on 6.4 (934 tests). I also cherry-picked the commit onto 7.4, 8.1 and 8.2 without conflicts, and the Yaml suite passes on 8.2.

@lazerg

lazerg commented Oct 12, 2026

Copy link
Copy Markdown
Contributor Author

The "Unit Tests (8.4, high-deps)" failure is not caused by this change: Composer got an empty zip for symfony/dependency-injection while it installed the FrameworkBundle dependencies, so the tests did not run.

@nicolas-grekas

Copy link
Copy Markdown
Member

Thank you @lazerg.

@nicolas-grekas
nicolas-grekas merged commit c7f1256 into symfony:6.4 Oct 12, 2026
13 of 14 checks passed
This was referenced Oct 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants