Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.This was previously reported to the Drupal Security Team and has been deemed appropriate for a public issue.
Problem/Motivation
In some site configurations the /media/oembed endpoint, if passed a bad hash value, returns a cacheable response. In these circumstances all media OEmbeds will be broken.
Proposed resolution
Return an uncacheable response to bad input.
Release notes snippet
@todo
Background information
- security.drupal.org private issue: https://security.drupal.org/node/175983
(included for reference. Please do not report access denied as an error.)
| Comment | File | Size | Author |
|---|---|---|---|
| #9 | 3366481-9.patch | 3.67 KB | cilefen |
| #9 | 3366481-9-test.patch | 1.65 KB | cilefen |
Comments
Comment #2
cilefen commentedCommitters: please also credit seanB, acbramley, and phenaproxima.
I am testing my original patch.
Comment #6
catchComment #7
cilefen commentedA reroll.
Comment #9
cilefen commentedComment #11
cilefen commentedComment #12
smustgrave commentedReviewing change and seems to throw Bad Request vs Access Denied now.
Comment #16
catchCommitted/pushed to 11.x and cherry-picked back through to 9.5.x, thanks!
Comment #18
wim leersWow, nice catch!