Problem/Motivation
This was reported by becw to the security team, but was cleared as there is no security concerns. It can be fixed publicly.
When the RDF module is enabled, it renders the $account->name property directly in an HTML meta tag on user profile pages without running it through format_username(). This is only visible to users who have permission to view user profiles.
Exposing usernames probably isn't a security hole, but if a site is doing something terrible like setting the account name = email... well, that's probably the site's own fault.
There is no risk of XSS here because the value is sanitized with drupal_attributes(). see also http://drupal.org/node/1004778
Since #2112679: getUsername() should return the username getDisplayName() for the formatted user name was committed the rdf module uses $account->getDisplayName(), fixing the problem stated here. That was committed on Wed Sep 23 17:26:38 2015. However, that patch did not update the rdf tests to confirm that the display name was being used. This issue is to update the tests to confirm that the altered user name is displayed,
Steps to reproduce
Proposed resolution
Enable the existing user_hooks_test module that uses format_name_alter to alter the username in the relevant rdf tests. These are CommentAttributesTest and UserAttributesTest.php.
Remaining tasks
Review
Commit
| Comment | File | Size | Author |
|---|---|---|---|
| #77 | 1929420-77.patch | 5.41 KB | quietone |
| #77 | diff-69-77.txt | 860 bytes | quietone |
| #69 | 1929420-69.patch | 5.43 KB | quietone |
| #69 | interdiff-66-68.txt | 695 bytes | quietone |
| #66 | 1929420-66.patch | 5.43 KB | quietone |
Comments
Comment #1
floydm commentedIn D8
format_username()has becomeuser_format_name(). A patch that calls it for the RDF header on user profiles is attached.Comment #2
scor commentedThanks Floydm for getting the ball running. We might also want to update the occurrences of
->namein core/modules/rdf/lib/Drupal/rdf/Tests/ to be consistent across the board.Comment #3
floydm commentedYes, right.
A new patch is attached that also changes the four references to
->namefrom the tests touser_format_name(). The RDF tests ran cleanly on my box after these changes.Comment #4
seiplax commentedVerifying that the patch works on 8.0-dev.
We have the same issue in D7 since we use realname module to separate first and last name. Would be great if this could be ported to D7.
Comment #5
jesse.d commentedLooks good to me.
Applied the patch in #3 to the latest version of D8 with no problem. It passed tests and the output looked good after applying.
Comment #6
scor commented#3: drupal-format_username_in_rdf_output-1929420-3.patch queued for re-testing.
Patch #3 came back green. seconding that RTBC.
Comment #7
scor commentedadding backport tag.
Comment #8
alexpottIn reviewing this I realised we actually weren't really testing whether or not RDF output was using altered names as a result of using
user_format_name()so I've added a test module that implementshook_user_format_name_alter(). This exposed two things... CommentAttributesTest wasn't actually testing unverified users properly and we have an issue with user names longer than 20 characters.. the patch attached fixes the first issue but the second issue is bigger and out-of-scope so I'll raise a separate issue for it.Comment #9
alexpottThe promised issue... #1992954: Trimming of long usernames results in incorrect RDF
Comment #11
alexpott#8: 1929420-rdf-username.8.patch queued for re-testing.
Comment #12
mlncn commentedAll good. With this test we aren't ensuring that user_format_name() does the alter, but that's not the point, we're ensuring RDF definitely uses user_format_name() and doesn't undo or degrade it somehow.
Comment #13
scor commentedoops, copy / paste oversight from user_form_test.module. there should be a relevant comment there.
Comment #14
jrglasgow commented#8: 1929420-rdf-username.8.patch queued for re-testing.
Comment #15
mlncn commentedQuite right, updated that part of the code comment, patch and interdiff attached.
Comment #17
scor commented#15: 1929420-14-rdf-username-test-help-function-with-description.patch queued for re-testing.
Comment #19
kay_v commentedre-rolled patch from #15 and ran simpletest Drupal\rdf\Tests\CommentAttributesTest locally --success this time! 118 passes, 0 fails, 0 exceptions, and 16 debug messages (field o' green... nice!)
queued for testing
Comment #20
kay_v commentedComment #22
scor commentedThe user login is failing now because drupalLogin() in simpletest is using the rendered/altered username to login. Instead of using
$account->getUsername()in drupalLogin(), this patch should use$account->get('name')->valuefor now until getUsername() is fixed.I've filed #2112679: getUsername() should return the username getDisplayName() for the formatted user name to get getUsername() fixed.
Comment #23
kay_v commentedreroll and posting for testing
Comment #25
scor commentedLooks like your patch includes extra hunks which have already been committed (and should be removed from this patch):
core/lib/Drupal/Core/Form/FormBuilder.php
core/modules/comment/lib/Drupal/comment/CommentFormController.php
core/tests/Drupal/Tests/Core/Form/FormBuilderTest.php
The rest of the patch looks good.
Comment #26
kay_v commentedpatch for short-term review --more work to come on it
Comment #27
kay_v commentedrerolled patch; it was same as comment #26 --queuing for testing
Comment #29
scor commentedComment #30
krlucas commented#26 is failing because it's causing a bunch of non-related tests to fail because it changes drupalLogin() to use $account->get('name')->value instead of get->Username().
That's fine for user entities but other tests provide a session object instead of an entity. Going to take a look at the issue #2112679 which scor created above as that might make the use get->Username() work fine.
Comment #31
ianthomas_ukuser_format_name() has been deprecated, we should just call ->getUsername() on the $account object ourselves.
Comment #32
kay_v commentedComment #33
scor commentedComment #34
scor commentedWe now have a working patch at #2112679: getUsername() should return the username getDisplayName() for the formatted user name thanks to Kelly, which will need to be applied and included here until it get committed. Once this patch is applied/committed, the patch #26 should be greatly reduced... basically with only a few hunks from CommentAttributesTest.php left.
Comment #35
krlucas commentedI'll update the patch here to only include that test.
Comment #36
krlucas commentedHere's the patch just with updated test for comment attributes. Requires the pending patch in #2112679-29: getUsername() should return the username getDisplayName() for the formatted user name so it will fail.
Comment #38
seiplax commentedMerging 1929420-36-user-displayname-test.patch and 2112679-get_username-29.patch to test if they work together after talking to scor about it. Fails when running tests on localdev, but to rule out that it is not just my local dev I am posting it to see what the testbot says.
On local the errors are:
Comment #39
seiplax commentedwoops, wrong naming convention for the testbot
Comment #40
krlucas commentedSetting to needs review for test bot.
Comment #42
krlucas commentedHere's the fixed patch for the comment attributes test and a combined patch with #2112676-34 for mr. testbot.
Comment #44
jhedstromWhat's the status of this given #1977028: Remove RDF module from core?
Also, patch no longer applies.
Comment #45
scor commentedI'm not aware of any plans to remove the RDF module from core, #1977028 was an old issue which I closed. This patch still needs reroll though.
Comment #46
gbisht commentedPatch Rerolled!
Comment #48
krlucas commentedThe patch in #42 applies, it just fails tests because the tests it introduces remain dependent on #2112679: getUsername() should return the username getDisplayName() for the formatted user name which has not yet been committed. That's why #42 also contains a combined patch. Setting 2112679 as parent issue.
Comment #49
nlisgo commentedComment #51
nlisgo commentedThe previous patch is way too small and appears to be missing the user_name_test module
Comment #52
nlisgo commentedIf this isse has a dependency on #2112679: getUsername() should return the username getDisplayName() for the formatted user name would it be appropriate to mark this issue as postponed?
Comment #53
andypostbetter to scope the issue to rdf module and merge with "getDisplayName()" if will be allowed
This issue a just a bug report
Comment #54
alan d. commentedI assume "cleared as there is no security concerns" means that there is no XSS risk, however it is a minor security fail by exposing the login name, thus bumping priority accordingly.
Debatable on terrible; the entire need for a separate username and email address is terrible and old fashioned IMHO (forcing the need to create two separate unique properties per account)
Comment #55
jhedstromComment #64
pameeela commentedAnyone who is across this issue able to update in light of getUsername being deprecated?
Comment #65
pameeela commentedComment #66
quietone commentedThe fix for this was committed back in 2015 but the tests were not updated. They should be changed to confirm that the altered name is displayed. This patch should do that.
Comment #67
quietone commentedStarted tests on 9.1.x, Update title and move to 9.1.x.
Comment #68
longwaveNit: I think 0 should be an integer and not a string here.
Otherwise this looks good.
Comment #69
quietone commented@longwave, thanks.
Fix for the nit in #68.
Comment #70
longwaveThanks for fixing, RTBC assuming tests pass.
Comment #71
larowlanminor nit: can be fixed on commit - this is now > 80 chars so the entries should be on their own line
Other than that, this looks ready in my book, I'll circle back once commit freeze is over
Comment #72
larowlanAdding issue credit for those who have provided reviews, issue summary updates
Comment #74
larowlanFixed on commit
Comment #76
larowlanThis needs re-rolling for 8.9
Backported to 9.0.x because this resolves a valid bug and there is little risk of disruption
Comment #77
quietone commentedReroll for 8.9.x
Comment #78
quietone commentedRemoving tag.
Comment #79
longwaveReroll is good, just the $modules property visibility and setUp method return type have changed.
Comment #80
larowlanCommitted e934b62 and pushed to 8.9.x. Thanks!
Backported to 8.9.x because this resolves a valid bug, has a passing test and there is little risk of disruption