Fix: Do not attempt to fetch and modify properties of something that isn't an object

phpstan.neon

@@ -1,2 +1,6 @@
 includes:
 	- vendor/phpstan/phpstan-strict-rules/rules.neon
+
+parameters:
+	ignoreErrors:
+		- '#Access to an undefined property object::\$bin.#'

src/Normalizer/BinNormalizer.php

@@ -28,7 +28,10 @@ public function normalize(string $json): string
             ));
         }
 
-        if (!\property_exists($decoded, 'bin') || !\is_array($decoded->bin)) {
+        if (!\is_object($decoded)
+            || !\property_exists($decoded, 'bin')
+            || !\is_array($decoded->bin)
+        ) {
             return $json;
         }
 

src/Normalizer/ComposerJsonNormalizer.php

@@ -35,13 +35,19 @@ public function __construct(string $schemaUri = 'https://getcomposer.org/schema.
 
     public function normalize(string $json): string
     {
-        if (null === \json_decode($json) && \JSON_ERROR_NONE !== \json_last_error()) {
+        $decoded = \json_decode($json);
+
+        if (null === $decoded && \JSON_ERROR_NONE !== \json_last_error()) {
             throw new \InvalidArgumentException(\sprintf(
                 '"%s" is not valid JSON.',
                 $json
             ));
         }
 
+        if (!\is_object($decoded)) {
+            return $json;
+        }
+
         return $this->normalizer->normalize($json);
     }
 }

src/Normalizer/ConfigHashNormalizer.php

@@ -36,6 +36,10 @@ public function normalize(string $json): string
             ));
         }
 
+        if (!\is_object($decoded)) {
+            return $json;
+        }
+
         $objectProperties = \array_intersect_key(
             \get_object_vars($decoded),
             \array_flip(self::$properties)

src/Normalizer/PackageHashNormalizer.php

@@ -41,6 +41,10 @@ public function normalize(string $json): string
             ));
         }
 
+        if (!\is_object($decoded)) {
+            return $json;
+        }
+
         $objectProperties = \array_intersect_key(
             \get_object_vars($decoded),
             \array_flip(self::$properties)

src/Normalizer/VersionConstraintNormalizer.php

@@ -57,6 +57,10 @@ public function normalize(string $json): string
             ));
         }
 
+        if (!\is_object($decoded)) {
+            return $json;
+        }
+
         $objectProperties = \array_intersect_key(
             \get_object_vars($decoded),
             \array_flip(self::$properties)

test/Unit/Normalizer/AbstractNormalizerTestCase.php

@@ -33,9 +33,7 @@ final public function testNormalizeRejectsInvalidJson(): void
     {
         $json = $this->faker()->realText();
 
-        $reflection = new \ReflectionClass($this->className());
-
-        $normalizer = $reflection->newInstanceWithoutConstructor();
+        $normalizer = $this->createNormalizer();
 
         $this->expectException(\InvalidArgumentException::class);
         $this->expectExceptionMessage(\sprintf(
@@ -46,6 +44,41 @@ final public function testNormalizeRejectsInvalidJson(): void
         $normalizer->normalize($json);
     }
 
+    /**
+     * @dataProvider providerJsonNotDecodingToObject
+     *
+     * @param string $json
+     */
+    final public function testNormalizeDoesNotModifyWhenJsonDecodedIsNotAnObject(string $json): void
+    {
+        $normalizer = $this->createNormalizer();
+
+        $normalized = $normalizer->normalize($json);
+
+        $this->assertSame($json, $normalized);
+    }
+
+    public function providerJsonNotDecodingToObject(): \Generator
+    {
+        $faker = $this->faker();
+
+        $values = [
+            'array' => $faker->words,
+            'bool-false' => false,
+            'bool-true' => true,
+            'float' => $faker->randomFloat(),
+            'int' => $faker->randomNumber(),
+            'null' => null,
+            'string' => $faker->sentence,
+        ];
+
+        foreach ($values as $key => $value) {
+            yield $key => [
+                \json_encode($value),
+            ];
+        }
+    }
+
     final protected function className(): string
     {
         return \preg_replace(
@@ -58,4 +91,11 @@ final protected function className(): string
             )
         );
     }
+
+    private function createNormalizer(): Normalizer\NormalizerInterface
+    {
+        $reflection = new \ReflectionClass($this->className());
+
+        return $reflection->newInstanceWithoutConstructor();
+    }
 }