bug symfony#54306 Throw TransformationFailedException when there is a null bytes injection (sormes)

This PR was squashed before being merged into the 5.4 branch.

Discussion
----------

Throw TransformationFailedException when there is a null bytes injection

| Q             | A
| ------------- | ---
| Branch?       | 5.4
| Bug fix?      | yes
| New feature?  | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Issues        | -  <!-- prefix each issue number with "Fix #", no need to create an issue if none exists, explain below instead -->
| License       | MIT

On one hand, in PHP 7, DateTime::createFromFormat allows null byte injection, and on the other hand, in PHP 8, it throws a ValueError that is not caught. This PR prevents injection when using version 5.4 under PHP 7 and onwards, throwing a TransformationFailedException.

Commits
-------

dd3c254 Throw TransformationFailedException when there is a null bytes injection

Author: fabpot

src/Symfony/Component/Form/Extension/Core/DataTransformer/DateTimeToStringTransformer.php

@@ -118,6 +118,10 @@ public function reverseTransform($value)
             throw new TransformationFailedException('Expected a string.');
         }
 
+        if (str_contains($value, "\0")) {
+            throw new TransformationFailedException('Null bytes not allowed');
+        }
+
         $outputTz = new \DateTimeZone($this->outputTimezone);
         $dateTime = \DateTime::createFromFormat($this->parseFormat, $value, $outputTz);
 

src/Symfony/Component/Form/Tests/Extension/Core/DataTransformer/DateTimeToStringTransformerTest.php

@@ -133,6 +133,19 @@ public function testReverseTransformEmpty()
         $this->assertNull($reverseTransformer->reverseTransform(''));
     }
 
+    public function testReverseTransformWithNullBytes()
+    {
+        $transformer = new DateTimeToStringTransformer();
+
+        $nullByte = \chr(0);
+        $value = '2024-03-15 21:11:00'.$nullByte;
+
+        $this->expectException(TransformationFailedException::class);
+        $this->expectExceptionMessage('Null bytes not allowed');
+
+        $transformer->reverseTransform($value);
+    }
+
     public function testReverseTransformWithDifferentTimezones()
     {
         $reverseTransformer = new DateTimeToStringTransformer('America/New_York', 'Asia/Hong_Kong', 'Y-m-d H:i:s');