[Security] Return default value instead of deferring to lower prio resolvers when using #[CurrentUser] and no user is found

Author: Seldaek

Controller/UserValueResolver.php

@@ -47,11 +47,6 @@ public function supports(Request $request, ArgumentMetadata $argument): bool
             return false;
         }
 
-        // if no user is present but a default value exists we delegate to DefaultValueResolver
-        if ($argument->hasDefaultValue() && null === $this->tokenStorage->getToken()?->getUser()) {
-            return false;
-        }
-
         return true;
     }
 
@@ -62,20 +57,21 @@ public function resolve(Request $request, ArgumentMetadata $argument): array
         if (UserInterface::class !== $argument->getType() && !$argument->getAttributesOfType(CurrentUser::class, ArgumentMetadata::IS_INSTANCEOF)) {
             return [];
         }
-        $user = $this->tokenStorage->getToken()?->getUser();
 
-        // if no user is present but a default value exists we delegate to DefaultValueResolver
-        if ($argument->hasDefaultValue() && null === $user) {
-            return [];
-        }
+        if (null === $user = $this->tokenStorage->getToken()?->getUser()) {
+            // if no user is present but a default value exists we use it to prevent the EntityValueResolver or others
+            // from attempting resolution of the User as the current logged in user was requested here
+            if ($argument->hasDefaultValue()) {
+                return [$argument->getDefaultValue()];
+            }
 
-        if (null === $user) {
             if (!$argument->isNullable()) {
                 throw new AccessDeniedException(sprintf('There is no logged-in user to pass to $%s, make the argument nullable if you want to allow anonymous access to the action.', $argument->getName()));
             }
 
             return [null];
         }
+
         if (null === $argument->getType() || $user instanceof ($argument->getType())) {
             return [$user];
         }

Tests/Controller/UserValueResolverTest.php

@@ -28,7 +28,7 @@
 class UserValueResolverTest extends TestCase
 {
     /**
-     * In Symfony 7, keep this test case but remove the call to supports()
+     * In Symfony 7, keep this test case but remove the call to supports().
      *
      * @group legacy
      */
@@ -43,18 +43,18 @@ public function testSupportsFailsWithNoType()
     }
 
     /**
-     * In Symfony 7, keep this test case but remove the call to supports()
+     * In Symfony 7, keep this test case but remove the call to supports().
      *
      * @group legacy
      */
     public function testSupportsFailsWhenDefaultValAndNoUser()
     {
         $tokenStorage = new TokenStorage();
         $resolver = new UserValueResolver($tokenStorage);
-        $metadata = new ArgumentMetadata('foo', UserInterface::class, false, true, new InMemoryUser('username', 'password'));
+        $metadata = new ArgumentMetadata('foo', UserInterface::class, false, true, $default = new InMemoryUser('username', 'password'));
 
-        $this->assertSame([], $resolver->resolve(Request::create('/'), $metadata));
-        $this->assertFalse($resolver->supports(Request::create('/'), $metadata));
+        $this->assertSame([$default], $resolver->resolve(Request::create('/'), $metadata));
+        $this->assertTrue($resolver->supports(Request::create('/'), $metadata));
     }
 
     public function testResolveSucceedsWithUserInterface()