Problem/Motivation

Test coverage was written for SA-CORE-2026-010, but has not yet been added to core.

Proposed resolution

Add the test coverage.

Remaining tasks

NR.

Issue fork drupal-3633160

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

xjm created an issue. See original summary.

xjm opened merge request !17557

xjm’s picture

xjm
she/her
Primary language English
commented
Status: Active » Needs review
smustgrave’s picture

smustgrave commented
Status: Needs review » Reviewed & tested by the community
Issue tags: +Needs Review Queue Initiative

Tested this one by reverting https://git.drupalcode.org/project/drupal/-/commit/e41cc6ff613d037e33bdc...
Applying the MR and running testNonPublicSchemeInvokesFileDownloadHook()

Behat\Mink\Exception\ExpectationException: Current response status code is 200, but 403 expected.
/var/www/html/vendor/behat/mink/src/WebAssert.php:888
/var/www/html/vendor/behat/mink/src/WebAssert.php:145
/var/www/html/core/modules/image/tests/src/Functional/ImageStyleDownloadAccessControlTest.php:135

I checked core/modules/image/tests/src/Functional/ImageStyleDownloadAccessControlTest.php since it's a functional file if installing the new module would be un-needed install but there are really 2 other tests so doubt it's a noticeable problem.

LGTM

catch made their first commit to this issue’s fork.

  • catch committed b0a3d2f5 on main 
    task: #3633160 Add test coverage for SA-CORE-2026-010

By: xjm
By: kim....

  • catch committed 0f58be91 on 11.5.x 
    task: #3633160 Add test coverage for SA-CORE-2026-010

By: xjm
By: kim....

  • catch committed 3344c1af on 11.x 
    task: #3633160 Add test coverage for SA-CORE-2026-010

By: xjm
By: kim....

  • catch committed 64671317 on 12.0.x 
    task: #3633160 Add test coverage for SA-CORE-2026-010

By: xjm
By: kim....
catch’s picture

catch
he/him
Primary language English
commented
Version: main » 11.5.x-dev
Status: Reviewed & tested by the community » Fixed
Issue tags: +Needs followup

Couple of nits on the MR but given this was RTBC for the security release, going ahead with the commit.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

smustgrave’s picture

smustgrave commented
Issue tags: -Needs followup

Opened #3633600: Use key/value over state in ImageModuleTestHooks tagged it for first time user.

  • xjm committed d3e51377 on 11.4.x authored by catch 
    task: #3633160 Add test coverage for SA-CORE-2026-010

By: xjm
By: kim....
xjm’s picture

xjm
she/her
Primary language English
commented
Version: 11.5.x-dev » 11.4.x-dev

Cherry-picked to 11.4.x also.