Configuration data is trusted during installation

Configuration data is trusted during extension installation.

Previously Drupal 8 would apply configuration schema and calculate the configuration entities dependencies during installation. This is expensive. It is up to the module and theme developer to ensure that configuration provided by the module conforms to its schema and has all the necessary dependency information.

In mitigation, if a single test is created that installs the extension and configuration does not conform then an error will be produced.

Additionally, if an module writes configuration and can ensure that the data written is the correct type it can mark the data as trusted. Configuration entities have a new trustData() method to do this. For example, the is no need to check configuration schema when adding a permission to a role.

function user_role_grant_permissions($rid, array $permissions = array()) {
  // Grant new permissions for the role.
  if ($role = Role::load($rid)) {
    foreach ($permissions as $permission) {
      $role->grantPermission($permission);
    }
    $role->trustData()->save();
  }
}

The simple configuration API method save() now accepts a boolean as to whether to trust the data or not. For example:

  // Enable the admin theme.
  \Drupal::configFactory()->getEditable('node.settings')->set('use_admin_theme', TRUE)->save(TRUE);

Trusting data is especially important in .install configuration saves since rebuilding schema throughout a Drupal install is expensive. In general, the only untrusted data should be coming from forms or command line tools like Drush.