Problem/Motivation

Test coverage was written for SA-CORE-2026-009, but has not yet been added to core.

Proposed resolution

Add the test coverage.

Remaining tasks

NR.

Issue fork drupal-3633166

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

xjm created an issue. See original summary.

xjm opened merge request !17558

xjm’s picture

xjm
she/her
Primary language English
commented
Status: Active » Needs review
smustgrave’s picture

smustgrave commented
Status: Needs review » Reviewed & tested by the community
Issue tags: +Needs Review Queue Initiative

Tested this one by reverting https://git.drupalcode.org/project/drupal/-/commit/31867e6906e1368accb0e...
Applying the MR and running testImageUploadMaliciousContent

Failed asserting that 201 is identical to 422.
/var/www/html/core/modules/jsonapi/tests/src/Functional/FileUploadTest.php:744

Had to think about the placement of the test since the original commit was in the file module but if I understand it correctly the bug is really core/modules/jsonapi/src/Controller/FileUpload.php.

No additional feedback.

  • catch committed fdcd7a15 on 11.5.x 
    task: #3633166 Add test coverage for SA-CORE-2026-009

By: xjm
By: kim....

  • catch committed dc3e514c on 11.x 
    task: #3633166 Add test coverage for SA-CORE-2026-009

By: xjm
By: kim....

  • catch committed 58c1deba on 12.0.x 
    task: #3633166 Add test coverage for SA-CORE-2026-009

By: xjm
By: kim....

  • catch committed 661002c9 on main 
    task: #3633166 Add test coverage for SA-CORE-2026-009

By: xjm
By: kim....
catch’s picture

catch
he/him
Primary language English
commented
Version: main » 11.5.x-dev
Status: Reviewed & tested by the community » Fixed

Committed/pushed to main and backported through to 11.5.x, thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • xjm committed dfcdf21f on 11.4.x authored by catch 
    task: #3633166 Add test coverage for SA-CORE-2026-009

By: xjm
By: kim....
xjm’s picture

xjm
she/her
Primary language English
commented
Version: 11.5.x-dev » 11.4.x-dev

Cherry-picked to 11.4.x also.