Merge remote-tracking branch 'jubianchi/create-object-secure'

baldurrensch · Jan 5, 2013 · da63267 · da63267
2 parents 054ad95 + acbf982
commit da63267
Showing 1 changed file with 18 additions and 1 deletion.
diff --git a/src/Nelmio/Alice/Loader/Base.php b/src/Nelmio/Alice/Loader/Base.php
@@ -207,7 +207,24 @@ private function getGenerator($locale = null)
 
     private function createObject($class, $name, $data)
     {
-        $obj = unserialize(sprintf('O:%d:"%s":0:{}', strlen($class), $class));
+        try {
+            $reflector = new \ReflectionMethod($class, '__construct');
+            $argc = $reflector->getNumberOfRequiredParameters();
+
+            if (0 === $argc) {
+                $obj = new $class();
+            } else {
+                if (-1 === version_compare(phpversion(), '5.4')) {
+                    $obj = unserialize(sprintf('O:%d:"%s":0:{}', strlen($class), $class));
+                } else {
+                    $reflector = new \ReflectionClass($class);
+                    $obj = $reflector->newInstanceWithoutConstructor();
+                }
+            }
+        } catch (\ReflectionException $exception) {
+            $obj = new $class();
+        }
+
         $variables = array();
         foreach ($data as $key => $val) {
             if (is_array($val) && '{' === key($val)) {