Issue 1:
Bug description: when using the built-in PropertyAccessor service, accessing an array property containing / in its key throws an error.

Example

in a standalone bin/test.php file, in a working Symfony instance

<?php
$loader = require __DIR__.'/../vendor/autoload.php';

$kernel = new AppKernel('dev', true);
$kernel->boot();

var_dump($kernel->getContainer()->get('property_accessor')->getValue(['a/b' => 'ok'], '[a/b]'));

execution and stack

$ php bin/test.php
PHP Fatal error: Uncaught Symfony\Component\Cache\Exception\InvalidArgumentException: Cache key "p[a/b]" contains reserved characters {}()/\@: in /var/www/current/vendor/symfony/symfony/src/Symfony/Component/Cache/CacheItem.php:162
Stack trace:
#0 /var/www/current/vendor/symfony/symfony/src/Symfony/Component/Cache/Traits/ArrayTrait.php(45): Symfony\Component\Cache\CacheItem::validateKey('p[a/b]')
#1 /var/www/current/vendor/symfony/symfony/src/Symfony/Component/Cache/Adapter/ArrayAdapter.php(56): Symfony\Component\Cache\Adapter\ArrayAdapter->hasItem('p[a/b]')
#2 /var/www/current/vendor/symfony/symfony/src/Symfony/Component/PropertyAccess/PropertyAccessor.php(875): Symfony\Component\Cache\Adapter\ArrayAdapter->getItem('p[a/b]')
#3 /var/www/current/vendor/symfony/symfony/src/Symfony/Component/PropertyAccess/PropertyAccessor.php(160): Symfony\Component\PropertyAccess\PropertyAccessor->getPropertyPath('[a/b]')
#4 /var/www/current/bin/test.php(8): Symfony\Component\PropertyAccess\PropertyAccessor->getValue(Array, '[a/b]')
#5 {main} in /var/www/current/vendor/symfony/symfony/src/Symfony/Component/Cache/CacheItem.php on line 162

Analysis

The PropertyAccessor component uses a standard PSR6 cache to increase it's performance, but the key is validated by Symfony\Component\Cache\CacheItem::validateKey, and some characters are forbidden. The problem is that any of those characters are allowed as an array key (source). It means some properties can never be accessed through the property accessor.

As a quick workaround, we will disable the cache.

Side note: an empty array key is also not reachable (even if it's certainly a bad practice...)

Resolution proposals

Hash the key (but should it be protected against collisions with a mapping ?)

Catch the cache component error, add a warning and skip caching for those property (not ideal, but a quick and safe solution...)

Find a way to escape those characters

Context

Symfony 3.4

PHP 7.2

Issue 2:
Symfony version(s) affected: 4.1.7, 4.1.5 (Serializer Component)

Description

CacheItem throws an Error: Cache key "p@triggers" contains reserved characters {}()/\@: when using the Serializer Services deserialize Method in combination with ObjectNormalizer and XmlEncoder (by passing an XML File and an Object to normalize, see Reproducer below)

This seems to happen when attributes are set on the xml "root" node.

How to reproduce

Checkout: https://github.com/e3n-internetagentur/bug-reproducer-symfony-xmlencoder-objectnormalizer-arrayadapter-cacheitem

execute composer install to load deps

execute the following commands

bin/console app:xml norootattributes.xml

bin/console app:xml rootattributes.xml

Command 1. just outputs some data.

Command 2. Fails with Cache key "p@triggers" contains reserved characters {}()/\@:

You can work around the issue by replacing $this->serializer = $serializer; in \App\Command\XmlCommand with $this->serializer = new Serializer([new ObjectNormalizer()], [new XmlEncoder()]);

The reason this works is probably because no "Caching" happens for the deserialize process, at least not in a way that it triggers the CacheItem.

Additional context

You can open the public folder where both test files reside, the only difference between them is that the root node in rootattributes.xml has an attribute.

There has been another ticket with a similar error message, but I think the cause there was different altogether (#26313)