Problem/Motivation

#2508654: File inclusion in transliteration service was solved but there's no indication the user wanted to do something nasty. Also the test is owie.

Proposed resolution

Just throw an exception if a path buster character is supplied in langcode and simplify the test.

Remaining tasks

User interface changes

API changes

Data model changes

CommentFileSizeAuthor
2508654_simplify.patch2.67 KBchx

Comments

chx created an issue. See original summary.

chx’s picture

chx commented
Status: Active » Needs review
dawehner’s picture

dawehner
Primary language German
commented 
  1. +++ b/core/lib/Drupal/Component/Transliteration/PhpTransliteration.php
@@ -243,7 +243,10 @@ protected function lookupReplacement($code, $unknown_character = '?') {
     // Figure out the file name to use by sanitizing the language code,
     // just in case.
-    $file = $this->dataDirectory . '/' . preg_replace('/[^a-zA-Z\-]/', '', $langcode) . '.php';
+    if (strpbrk($langcode, './\\')) {

    It feels better to document why we are doing exactly this strpbrk here ... 

  2. +++ b/core/tests/Drupal/Tests/Component/Transliteration/PhpTransliterationTest.php
@@ -173,20 +172,10 @@ public function testTransliterationWithMaxLength() {
    * Tests inclusion is safe.
    *
    * @covers ::readLanguageOverrides
+   * @expectedException \InvalidArgumentException
+   * @expectedExceptionMessage Invalid langcode
    */
   public function testSafeInclude() {
-    // The overrides in the transliteration data directory transliterates 0x82
-    // into "safe" but the overrides one directory higher transliterates the
-    // same character into "security hole". So by using "../index" as the
-    // language code we can test the ../ is stripped from the langcode.
-    vfsStream::setup('transliteration', NULL, [
-      'index.php' => '<?php $overrides = ["../index" => [0x82 => "security hole"]];',
-      'dir' => [
-        'index.php' => '<?php $overrides = ["../index" => [0x82 => "safe"]];',
-      ],
-    ]);
-    $transliteration = new PhpTransliteration(vfsStream::url('transliteration/dir'));
-    $transliterated = $transliteration->transliterate(chr(0xC2) . chr(0x82), '../index');
-    $this->assertSame($transliterated, 'safe');
+    (new PhpTransliteration(sys_get_temp_dir()))->transliterate(chr(0xC2) . chr(0x82), '../index');

    I love the improvement of the test

jibran queued 2508654_simplify.patch for re-testing.

amateescu’s picture

amateescu commented
Status: Needs review » Needs work 
+++ b/core/lib/Drupal/Component/Transliteration/PhpTransliteration.php
@@ -243,7 +243,10 @@ protected function lookupReplacement($code, $unknown_character = '?') {
     // Figure out the file name to use by sanitizing the language code,
     // just in case.
-    $file = $this->dataDirectory . '/' . preg_replace('/[^a-zA-Z\-]/', '', $langcode) . '.php';
+    if (strpbrk($langcode, './\\')) {

As @dawehner mentioned, we need to update the comment to match the new code :)

Version: 8.0.x-dev » 8.1.x-dev

Drupal 8.0.6 was released on April 6 and is the final bugfix release for the Drupal 8.0.x series. Drupal 8.0.x will not receive any further development aside from security fixes. Drupal 8.1.0-rc1 is now available and sites should prepare to update to 8.1.0.

Bug reports should be targeted against the 8.1.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

amateescu’s picture

amateescu commented

@dawehner, since @chx is sadly no longer active around here, can you please propose a comment for your review point from #3.1? :)

dawehner’s picture

dawehner
Primary language German
commented 
+++ b/core/lib/Drupal/Component/Transliteration/PhpTransliteration.php
@@ -243,7 +243,10 @@ protected function lookupReplacement($code, $unknown_character = '?') {
+    if (strpbrk($langcode, './\\')) {

So what about: "'.' and '\' could be part of a file tree traversal, so we don't allow them for a langcode, see https://www.drupal.org/node/2508654 or something similar?

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.9 was released on September 7 and is the final bugfix release for the Drupal 8.1.x series. Drupal 8.1.x will not receive any further development aside from security fixes. Drupal 8.2.0-rc1 is now available and sites should prepare to upgrade to 8.2.0.

Bug reports should be targeted against the 8.2.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.6 was released on February 1, 2017 and is the final full bugfix release for the Drupal 8.2.x series. Drupal 8.2.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.3.0 on April 5, 2017. (Drupal 8.3.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.3.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.4.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.4 was released on January 3, 2018 and is the final full bugfix release for the Drupal 8.4.x series. Drupal 8.4.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.5.0 on March 7, 2018. (Drupal 8.5.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.5.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.6 was released on August 1, 2018 and is the final bugfix release for the Drupal 8.5.x series. Drupal 8.5.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.6.0 on September 5, 2018. (Drupal 8.6.0-rc1 is available for testing.)

Bug reports should be targeted against the 8.6.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.8.x-dev

Drupal 8.6.x will not receive any further development aside from security fixes. Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.2.x-dev

Drupal 8 is end-of-life as of November 17, 2021. There will not be further changes made to Drupal 8. Bugfixes are now made to the 9.3.x and higher branches only. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.15 was released on June 1st, 2022 and is the final full bugfix release for the Drupal 9.3.x series. Drupal 9.3.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.4.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.9 was released on December 7, 2022 and is the final full bugfix release for the Drupal 9.4.x series. Drupal 9.4.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.5.x-dev branch from now on, and new development or disruptive changes should be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

smustgrave’s picture

smustgrave commented
Status: Needs work » Postponed (maintainer needs more info)
Issue tags: +stale-issue-cleanup

Thank you for creating this issue to improve Drupal.

We are working to decide if this task is still relevant to a currently supported version of Drupal. There hasn't been any discussion here for over 8 years which suggests that this has either been implemented or is no longer relevant. Your thoughts on this will allow a decision to be made.

Since we need more information to move forward with this issue, the status is now Postponed (maintainer needs more info). If we don't receive additional information to help with the issue, it may be closed after three months.

Thanks!

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.

smustgrave’s picture

smustgrave commented

Wanted to bump 1 more time if still a valid test.