diff --git a/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFastFileStorage.php b/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFastFileStorage.php index f82b676..0a907cf 100644 --- a/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFastFileStorage.php +++ b/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFastFileStorage.php @@ -116,6 +116,10 @@ public function save($name, $data) { * modified, invalidating the file, thus protecting against untrusted code * getting executed. * + * In an effort to keep paths from getting overly long, we only use the + * first 10 hexadecimal characters (2^40 bits). This gives us more than a + * trillion unique filenames so unexpected collisions are not an issue. + * * @param string $name * The virtual file name. Can be a relative path. * @param string $directory @@ -135,7 +139,8 @@ public function getFullPath($name, &$directory = NULL, &$directory_mtime = NULL) if (!isset($directory_mtime)) { $directory_mtime = file_exists($directory) ? filemtime($directory) : 0; } - return $directory . '/' . hash_hmac('sha256', $name, $this->secret . $directory_mtime) . '.php'; + $hashed_name = substr(hash_hmac('sha256', $name, $this->secret . $directory_mtime), 0, 10) . '.php'; + return $directory . '/' . $hashed_name; } /** @@ -207,7 +212,10 @@ protected function getContainingDirectoryFullPath($name) { if (substr($name, -4) === '.php') { $name = substr($name, 0, -4); } - return $this->directory . '/' . str_replace('/', '#', $name); + + // Prevent overly-long paths when using verbose template suggestions, for + // example, by truncating the Twig template name to 30 characters. + return $this->directory . '/' . str_replace('/', '#', substr($name, 0, 30)); } /** diff --git a/core/lib/Drupal/Core/Template/TwigPhpStorageCache.php b/core/lib/Drupal/Core/Template/TwigPhpStorageCache.php index d2cf918..3455e14 100644 --- a/core/lib/Drupal/Core/Template/TwigPhpStorageCache.php +++ b/core/lib/Drupal/Core/Template/TwigPhpStorageCache.php @@ -72,7 +72,9 @@ protected function storage() { * {@inheritdoc} */ public function generateKey($name, $className) { - $hash = hash('sha256', $className); + // Prevent overly-long path names by using the first 10 chars of the hash. + // This gives us over a trillion potential keys. + $hash = substr(hash('sha256', $className), 0, 10); if (strpos($name, '{# inline_template_start #}') === 0) { // $name is an inline template, and can have characters that are not valid