fix: clone Parameters before mutation in security and validator providers (#8378)

Author: ostrolucky

src/State/Provider/SecurityParameterProvider.php

@@ -52,7 +52,8 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
 
         $operation = $request?->attributes->get('_api_operation') ?? $operation;
 
-        $parameters = $operation->getParameters() ?? new Parameters();
+        $existingParameters = $operation->getParameters();
+        $parameters = $existingParameters ? clone $existingParameters : new Parameters();
 
         if ($operation instanceof HttpOperation) {
             foreach ($operation->getUriVariables() ?? [] as $key => $uriVariable) {

src/State/Tests/Provider/SecurityParameterProviderTest.php

@@ -15,6 +15,7 @@
 
 use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Link;
+use ApiPlatform\Metadata\Parameters;
 use ApiPlatform\Metadata\ResourceAccessCheckerInterface;
 use ApiPlatform\State\Provider\SecurityParameterProvider;
 use ApiPlatform\State\ProviderInterface;
@@ -28,16 +29,18 @@ public function testIsGrantedLink(): void
     {
         $obj = new \stdClass();
         $barObj = new \stdClass();
+        $sharedParams = new Parameters();
         $operation = new GetCollection(uriVariables: [
             'barId' => new Link(toProperty: 'bar', fromClass: 'Bar', security: 'is_granted("some_voter", "bar")'),
-        ], class: \stdClass::class);
+        ], class: \stdClass::class, parameters: $sharedParams);
         $decorated = $this->createMock(ProviderInterface::class);
         $decorated->method('provide')->willReturn($obj);
         $request = new Request(attributes: ['bar' => $barObj]);
         $resourceAccessChecker = $this->createMock(ResourceAccessCheckerInterface::class);
         $resourceAccessChecker->expects($this->once())->method('isGranted')->with('Bar', 'is_granted("some_voter", "bar")', ['object' => $obj, 'previous_object' => null, 'request' => $request, 'bar' => $barObj, 'barId' => 1, 'operation' => $operation])->willReturn(true);
         $accessChecker = new SecurityParameterProvider($decorated, $resourceAccessChecker);
         $accessChecker->provide($operation, ['barId' => 1], ['request' => $request]);
+        $this->assertCount(0, $sharedParams, 'provide() must not mutate the Parameters object stored on the cached operation');
     }
 
     public function testIsNotGrantedLink(): void

src/Symfony/Validator/State/ParameterValidatorProvider.php

@@ -52,7 +52,8 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
         }
 
         $constraintViolationList = new ConstraintViolationList();
-        $parameters = $operation->getParameters() ?? new Parameters();
+        $existingParameters = $operation->getParameters();
+        $parameters = $existingParameters ? clone $existingParameters : new Parameters();
 
         if ($operation instanceof HttpOperation) {
             foreach ($operation->getUriVariables() ?? [] as $key => $uriVariable) {