Problem/Motivation

This was reported by becw to the security team, but was cleared as there is no security concerns. It can be fixed publicly.

When the RDF module is enabled, it renders the $account->name property directly in an HTML meta tag on user profile pages without running it through format_username(). This is only visible to users who have permission to view user profiles.

Exposing usernames probably isn't a security hole, but if a site is doing something terrible like setting the account name = email... well, that's probably the site's own fault.

There is no risk of XSS here because the value is sanitized with drupal_attributes(). see also http://drupal.org/node/1004778

Since #2112679: getUsername() should return the username getDisplayName() for the formatted user name was committed the rdf module uses $account->getDisplayName(), fixing the problem stated here. That was committed on Wed Sep 23 17:26:38 2015. However, that patch did not update the rdf tests to confirm that the display name was being used. This issue is to update the tests to confirm that the altered user name is displayed,

Steps to reproduce

Proposed resolution

Enable the existing user_hooks_test module that uses format_name_alter to alter the username in the relevant rdf tests. These are CommentAttributesTest and UserAttributesTest.php.

Remaining tasks

Review
Commit

Comments

floydm’s picture

Status: Active » Needs review
StatusFileSize
new516 bytes

In D8 format_username() has become user_format_name(). A patch that calls it for the RDF header on user profiles is attached.

scor’s picture

Status: Needs review » Needs work

Thanks Floydm for getting the ball running. We might also want to update the occurrences of ->name in core/modules/rdf/lib/Drupal/rdf/Tests/ to be consistent across the board.

floydm’s picture

Status: Needs work » Needs review
StatusFileSize
new2.68 KB

Yes, right.

A new patch is attached that also changes the four references to ->name from the tests to user_format_name(). The RDF tests ran cleanly on my box after these changes.

seiplax’s picture

Verifying that the patch works on 8.0-dev.

We have the same issue in D7 since we use realname module to separate first and last name. Would be great if this could be ported to D7.

jesse.d’s picture

Looks good to me.

Applied the patch in #3 to the latest version of D8 with no problem. It passed tests and the output looked good after applying.

scor’s picture

Status: Needs review » Reviewed & tested by the community

#3: drupal-format_username_in_rdf_output-1929420-3.patch queued for re-testing.

Patch #3 came back green. seconding that RTBC.

scor’s picture

Issue tags: +Needs backport to D7

adding backport tag.

alexpott’s picture

Title: format_username() should be used when outputing username in RDF module » user_format_name() should be used when outputing username in RDF module
Status: Reviewed & tested by the community » Needs review
StatusFileSize
new3.89 KB
new5.88 KB

In reviewing this I realised we actually weren't really testing whether or not RDF output was using altered names as a result of using user_format_name() so I've added a test module that implements hook_user_format_name_alter(). This exposed two things... CommentAttributesTest wasn't actually testing unverified users properly and we have an issue with user names longer than 20 characters.. the patch attached fixes the first issue but the second issue is bigger and out-of-scope so I'll raise a separate issue for it.

alexpott’s picture

Status: Needs review » Needs work
Issue tags: -Needs backport to D7

The last submitted patch, 1929420-rdf-username.8.patch, failed testing.

alexpott’s picture

Status: Needs work » Needs review
Issue tags: +Needs backport to D7

#8: 1929420-rdf-username.8.patch queued for re-testing.

mlncn’s picture

Status: Needs review » Reviewed & tested by the community

All good. With this test we aren't ensuring that user_format_name() does the alter, but that's not the point, we're ensuring RDF definitely uses user_format_name() and doesn't undo or degrade it somehow.

scor’s picture

Status: Reviewed & tested by the community » Needs work
+++ b/core/modules/user/tests/modules/user_format_name_test/user_format_name_test.module
@@ -0,0 +1,15 @@
+ * Sets up a form that allows a user to validate password.

oops, copy / paste oversight from user_form_test.module. there should be a relevant comment there.

jrglasgow’s picture

Status: Needs work » Needs review

#8: 1929420-rdf-username.8.patch queued for re-testing.

mlncn’s picture

Quite right, updated that part of the code comment, patch and interdiff attached.

Status: Needs review » Needs work
Issue tags: -Needs backport to D7
scor’s picture

Status: Needs work » Needs review

Status: Needs review » Needs work
Issue tags: +Needs backport to D7
kay_v’s picture

re-rolled patch from #15 and ran simpletest Drupal\rdf\Tests\CommentAttributesTest locally --success this time! 118 passes, 0 fails, 0 exceptions, and 16 debug messages (field o' green... nice!)

queued for testing

kay_v’s picture

Status: Needs work » Needs review

Status: Needs review » Needs work
scor’s picture

The user login is failing now because drupalLogin() in simpletest is using the rendered/altered username to login. Instead of using $account->getUsername() in drupalLogin(), this patch should use $account->get('name')->value for now until getUsername() is fixed.

I've filed #2112679: getUsername() should return the username getDisplayName() for the formatted user name to get getUsername() fixed.

kay_v’s picture

Status: Needs work » Needs review
StatusFileSize
new8.83 KB

reroll and posting for testing

Status: Needs review » Needs work
scor’s picture

Looks like your patch includes extra hunks which have already been committed (and should be removed from this patch):
core/lib/Drupal/Core/Form/FormBuilder.php
core/modules/comment/lib/Drupal/comment/CommentFormController.php
core/tests/Drupal/Tests/Core/Form/FormBuilderTest.php

The rest of the patch looks good.

kay_v’s picture

Assigned: Unassigned » kay_v
Issue summary: View changes
StatusFileSize
new5.46 KB

patch for short-term review --more work to come on it

kay_v’s picture

Status: Needs work » Needs review

rerolled patch; it was same as comment #26 --queuing for testing

Status: Needs review » Needs work
scor’s picture

Issue tags: +RDF code sprint
krlucas’s picture

#26 is failing because it's causing a bunch of non-related tests to fail because it changes drupalLogin() to use $account->get('name')->value instead of get->Username().

That's fine for user entities but other tests provide a session object instead of an entity. Going to take a look at the issue #2112679 which scor created above as that might make the use get->Username() work fine.

ianthomas_uk’s picture

Title: user_format_name() should be used when outputing username in RDF module » $account->getUsername() should be used when outputing username in RDF module

user_format_name() has been deprecated, we should just call ->getUsername() on the $account object ourselves.

kay_v’s picture

Assigned: kay_v » Unassigned
scor’s picture

We now have a working patch at #2112679: getUsername() should return the username getDisplayName() for the formatted user name thanks to Kelly, which will need to be applied and included here until it get committed. Once this patch is applied/committed, the patch #26 should be greatly reduced... basically with only a few hunks from CommentAttributesTest.php left.

krlucas’s picture

Assigned: Unassigned » krlucas

I'll update the patch here to only include that test.

krlucas’s picture

Assigned: krlucas » Unassigned
Status: Needs work » Needs review
StatusFileSize
new2.31 KB
new2.77 KB

Here's the patch just with updated test for comment attributes. Requires the pending patch in #2112679-29: getUsername() should return the username getDisplayName() for the formatted user name so it will fail.

Status: Needs review » Needs work

The last submitted patch, 36: 1929420-36-user-displayname-test.patch, failed testing.

seiplax’s picture

StatusFileSize
new41.16 KB

Merging 1929420-36-user-displayname-test.patch and 2112679-get_username-29.patch to test if they work together after talking to scor about it. Fails when running tests on localdev, but to rule out that it is not just my local dev I am posting it to see what the testbot says.

On local the errors are:

Comment type found in RDF output (sioct:Comment).	Other	CommentAttributesTest.php	239	Drupal\rdf\Tests\CommentAttributesTest->_testBasicCommentRdfaMarkup()	Fail
Comment type found in RDF output (sioc:Post).	Other	CommentAttributesTest.php	245	Drupal\rdf\Tests\CommentAttributesTest->_testBasicCommentRdfaMarkup()	Fail
Comment subject found in RDF output (dc:title).	Other	CommentAttributesTest.php	253	Drupal\rdf\Tests\CommentAttributesTest->_testBasicCommentRdfaMarkup()	Fail
Comment date found in RDF output (dc:date).	Other	CommentAttributesTest.php	261	Drupal\rdf\Tests\CommentAttributesTest->_testBasicCommentRdfaMarkup()	Fail
Comment date found in RDF output (dc:created).	Other	CommentAttributesTest.php	268	Drupal\rdf\Tests\CommentAttributesTest->_testBasicCommentRdfaMarkup()	Fail
Comment body found in RDF output (content:encoded).	Other	CommentAttributesTest.php	276	Drupal\rdf\Tests\CommentAttributesTest->_testBasicCommentRdfaMarkup()	Fail
Comment relation to author found in RDF output (sioc:has_creator).	Other	CommentAttributesTest.php	286	Drupal\rdf\Tests\CommentAttributesTest->_testBasicCommentRdfaMarkup()

Comment type found in RDF output (sioct:Comment).	Other	CommentAttributesTest.php	239	Drupal\rdf\Tests\CommentAttributesTest->_testBasicCommentRdfaMarkup()	Fail
Comment type found in RDF output (sioc:Post).	Other	CommentAttributesTest.php	245	Drupal\rdf\Tests\CommentAttributesTest->_testBasicCommentRdfaMarkup()	Fail
Comment subject found in RDF output (dc:title).	Other	CommentAttributesTest.php	253	Drupal\rdf\Tests\CommentAttributesTest->_testBasicCommentRdfaMarkup()	Fail
Comment date found in RDF output (dc:date).	Other	CommentAttributesTest.php	261	Drupal\rdf\Tests\CommentAttributesTest->_testBasicCommentRdfaMarkup()	Fail
Comment date found in RDF output (dc:created).	Other	CommentAttributesTest.php	268	Drupal\rdf\Tests\CommentAttributesTest->_testBasicCommentRdfaMarkup()	Fail
Comment body found in RDF output (content:encoded).	Other	CommentAttributesTest.php	276	Drupal\rdf\Tests\CommentAttributesTest->_testBasicCommentRdfaMarkup()	Fail
Comment relation to author found in RDF output (sioc:has_creator).	Other	CommentAttributesTest.php	295	Drupal\rdf\Tests\CommentAttributesTest->_testBasicCommentRdfaMarkup()	Fail
InvalidArgumentException: $resource cannot be null in EasyRdf_Graph->checkResourceParam() (line 433 of /Library/WebServer/Documents/d8/core/vendor/easyrdf/easyrdf/lib/EasyRdf/Graph.php).
EasyRdf_Graph->checkResourceParam(NULL)
EasyRdf_Graph->hasProperty(NULL, 'http://xmlns.com/foaf/0.1/name', Array)
Drupal\rdf\Tests\CommentAttributesTest->_testBasicCommentRdfaMarkup(Object, Object)
Drupal\rdf\Tests\CommentAttributesTest->testCommentRdfaMarkup()
Drupal\simpletest\TestBase->run()
_simpletest_batch_operation(Array, '8', Array)
call_user_func_array('_simpletest_batch_operation', Array)
_batch_process()
_batch_do()
_batch_page(Object)
Drupal\system\Controller\BatchController->batchPage(Object)
call_user_func_array(Array, Array)
Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object, 1)
Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1)
Drupal\Core\HttpKernel->handle(Object, 1, 1)
Drupal\Core\DrupalKernel->handle(Object)
drupal_handle_request()
Uncaught exception	Graph.php	433	EasyRdf_Graph->checkResourceParam()
seiplax’s picture

StatusFileSize
new41.16 KB

woops, wrong naming convention for the testbot

krlucas’s picture

Status: Needs work » Needs review

Setting to needs review for test bot.

Status: Needs review » Needs work

The last submitted patch, 39: 1929420-39-account-getusername.patch, failed testing.

krlucas’s picture

Status: Needs work » Needs review
StatusFileSize
new2.73 KB
new41.54 KB
new1.44 KB

Here's the fixed patch for the comment attributes test and a combined patch with #2112676-34 for mr. testbot.

The last submitted patch, 42: account_getusername_1929420-42.patch, failed testing.

jhedstrom’s picture

Status: Needs review » Needs work
Issue tags: +Needs reroll

What's the status of this given #1977028: Remove RDF module from core?

Also, patch no longer applies.

scor’s picture

I'm not aware of any plans to remove the RDF module from core, #1977028 was an old issue which I closed. This patch still needs reroll though.

gbisht’s picture

Status: Needs work » Needs review
Issue tags: +SprintWeekend2015
StatusFileSize
new39.76 KB

Patch Rerolled!

Status: Needs review » Needs work

The last submitted patch, 46: account_getusername_1929420-46.patch, failed testing.

krlucas’s picture

The patch in #42 applies, it just fails tests because the tests it introduces remain dependent on #2112679: getUsername() should return the username getDisplayName() for the formatted user name which has not yet been committed. That's why #42 also contains a combined patch. Setting 2112679 as parent issue.

nlisgo’s picture

Status: Needs work » Needs review
Issue tags: -Needs reroll
StatusFileSize
new2.77 KB

Status: Needs review » Needs work

The last submitted patch, 49: account_getusername_-1929420-49.patch, failed testing.

nlisgo’s picture

The previous patch is way too small and appears to be missing the user_name_test module

nlisgo’s picture

If this isse has a dependency on #2112679: getUsername() should return the username getDisplayName() for the formatted user name would it be appropriate to mark this issue as postponed?

andypost’s picture

alan d.’s picture

Priority: Normal » Major

I assume "cleared as there is no security concerns" means that there is no XSS risk, however it is a minor security fail by exposing the login name, thus bumping priority accordingly.

site is doing something terrible like setting the account name

Debatable on terrible; the entire need for a separate username and email address is terrible and old fashioned IMHO (forcing the need to create two separate unique properties per account)

jhedstrom’s picture

Version: 8.0.x-dev » 8.1.x-dev

Drupal 8.0.6 was released on April 6 and is the final bugfix release for the Drupal 8.0.x series. Drupal 8.0.x will not receive any further development aside from security fixes. Drupal 8.1.0-rc1 is now available and sites should prepare to update to 8.1.0.

Bug reports should be targeted against the 8.1.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.9 was released on September 7 and is the final bugfix release for the Drupal 8.1.x series. Drupal 8.1.x will not receive any further development aside from security fixes. Drupal 8.2.0-rc1 is now available and sites should prepare to upgrade to 8.2.0.

Bug reports should be targeted against the 8.2.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.6 was released on February 1, 2017 and is the final full bugfix release for the Drupal 8.2.x series. Drupal 8.2.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.3.0 on April 5, 2017. (Drupal 8.3.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.3.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.4.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.4 was released on January 3, 2018 and is the final full bugfix release for the Drupal 8.4.x series. Drupal 8.4.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.5.0 on March 7, 2018. (Drupal 8.5.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.5.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.6 was released on August 1, 2018 and is the final bugfix release for the Drupal 8.5.x series. Drupal 8.5.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.6.0 on September 5, 2018. (Drupal 8.6.0-rc1 is available for testing.)

Bug reports should be targeted against the 8.6.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.8.x-dev

Drupal 8.6.x will not receive any further development aside from security fixes. Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

pameeela’s picture

Anyone who is across this issue able to update in light of getUsername being deprecated?

pameeela’s picture

Issue tags: +Bug Smash Initiative
quietone’s picture

Issue summary: View changes
Status: Needs work » Needs review
Issue tags: -Needs issue summary update
StatusFileSize
new7.6 KB
new5.43 KB

The fix for this was committed back in 2015 but the tests were not updated. They should be changed to confirm that the altered name is displayed. This patch should do that.

quietone’s picture

Title: $account->getUsername() should be used when outputing username in RDF module » $account->getDisplayName() should be used when outputing username in RDF module
Version: 8.9.x-dev » 9.1.x-dev

Started tests on 9.1.x, Update title and move to 9.1.x.

longwave’s picture

Status: Needs review » Needs work
+++ b/core/modules/rdf/tests/src/Functional/CommentAttributesTest.php
@@ -187,12 +194,13 @@ public function testCommentRdfaMarkup() {
+    $anonymous = User::load('0');

Nit: I think 0 should be an integer and not a string here.

Otherwise this looks good.

quietone’s picture

Status: Needs work » Needs review
StatusFileSize
new695 bytes
new5.43 KB

@longwave, thanks.

Fix for the nit in #68.

longwave’s picture

Status: Needs review » Reviewed & tested by the community

Thanks for fixing, RTBC assuming tests pass.

larowlan’s picture

+++ b/core/modules/rdf/tests/src/Functional/CommentAttributesTest.php
@@ -24,7 +25,7 @@ class CommentAttributesTest extends CommentTestBase {
+  protected static $modules = ['views', 'node', 'comment', 'rdf', 'user_hooks_test'];

minor nit: can be fixed on commit - this is now > 80 chars so the entries should be on their own line

Other than that, this looks ready in my book, I'll circle back once commit freeze is over

larowlan’s picture

Adding issue credit for those who have provided reviews, issue summary updates

  • larowlan committed 4e7ba76 on 9.1.x
    Issue #1929420 by krlucas, kay_v, quietone, seiplax, floydm, alexpott,...
larowlan’s picture

Title: $account->getDisplayName() should be used when outputing username in RDF module » [backport] $account->getDisplayName() should be used when outputing username in RDF module
Version: 9.1.x-dev » 9.0.x-dev

Fixed on commit

diff --git a/core/modules/rdf/tests/src/Functional/CommentAttributesTest.php b/core/modules/rdf/tests/src/Functional/CommentAttributesTest.php
index 5989a55b44..dd913bfabf 100644
--- a/core/modules/rdf/tests/src/Functional/CommentAttributesTest.php
+++ b/core/modules/rdf/tests/src/Functional/CommentAttributesTest.php
@@ -25,7 +25,13 @@ class CommentAttributesTest extends CommentTestBase {
    *
    * @var array
    */
-  protected static $modules = ['views', 'node', 'comment', 'rdf', 'user_hooks_test'];
+  protected static $modules = [
+    'views',
+    'node',
+    'comment',
+    'rdf',
+    'user_hooks_test',
+  ];

   /**
    * {@inheritdoc}

  • larowlan committed f952dc4 on 9.0.x
    Issue #1929420 by krlucas, kay_v, quietone, seiplax, floydm, alexpott,...
larowlan’s picture

Version: 9.0.x-dev » 8.9.x-dev
Status: Reviewed & tested by the community » Patch (to be ported)
Issue tags: +Needs reroll

This needs re-rolling for 8.9

Backported to 9.0.x because this resolves a valid bug and there is little risk of disruption

quietone’s picture

StatusFileSize
new860 bytes
new5.41 KB

Reroll for 8.9.x

quietone’s picture

Issue tags: -Needs reroll

Removing tag.

longwave’s picture

Status: Patch (to be ported) » Reviewed & tested by the community

Reroll is good, just the $modules property visibility and setUp method return type have changed.

larowlan’s picture

Title: [backport] $account->getDisplayName() should be used when outputing username in RDF module » $account->getDisplayName() should be used when outputing username in RDF module
Status: Reviewed & tested by the community » Fixed

Committed e934b62 and pushed to 8.9.x. Thanks!

Backported to 8.9.x because this resolves a valid bug, has a passing test and there is little risk of disruption

  • larowlan committed e934b62 on 8.9.x
    Issue #1929420 by quietone, krlucas, kay_v, seiplax, floydm, alexpott,...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.