Problem/Motivation

Unlike default entry point install process has no error handler so PHP errors come out. In some cases this leads to interesting security implications. For example this URL core/install.php?profile=foo causes the following PHP warning.

User warning: The following module is missing from the file system: foo in drupal_get_filename()

The URL can be used to built a list of contributed modules existing on a given Drupal 8 site.

You can see it in action on drupal.com.

http://drupal.com/core/install.php?profile=foo // Emits PHP warning because foo is missing.
http://drupal.com/core/install.php?profile=node // Emits no PHP warnings because node is found.

Note that this is not the only way to check modules on Drupal site. For instance www.drupalxray.com I take it checks HTTP response code for known module files to find out if a module is used on a site. However their approach is not so reliable as this one because it needs somehow to determine the directory of contributed modules (say modules, modules/contrib, profiles/PROFILE_NAME/modules, etc).

The issue initially was reported on security.drupal.org and posted here after security team approval.

Steps to reproduce

Unauthenticated user tries to install Drupal and specifies invalid `profile`:
https://victim.site/core/install.php?profile=%3Cinvalid%20value%3E

Application responds with an error:

User warning: The following module is missing from the file system: invalidvalue in drupal_get_filename() (line 240 of core/includes/bootstrap.inc).
drupal_get_filename('module', 'invalidvalue') (Line: 263)
drupal_get_path('profile', 'invalidvalue') (Line: 244)
Drupal\Core\Extension\ExtensionDiscovery->setProfileDirectoriesFromSettings() (Line: 157)
Drupal\Core\Extension\ExtensionDiscovery->scan('module') (Line: 148)
drupal_required_modules() (Line: 1087)
install_profile_info('minimal') (Line: 1236)
_install_select_profile(Array) (Line: 440)
install_begin_request(Object, Array) (Line: 114)
install_drupal(Object) (Line: 44)

...

After some time, the application stops working for authenticated users (Denial of Service). Functionality is "fixed" when the following URL is accessed:
http://victim.site/core/install.php?profile=standard
From #2878767: "The following module is missing from the file system" when specifying an invalid install profile as a query parameter

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

Comments

Chi created an issue. See original summary.

chi’s picture

chi commented
Issue summary: View changes
chi’s picture

chi commented

Here is a simple CLI tool proving the concept.

chi’s picture

chi commented
Issue summary: View changes

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.0-alpha1 will be released the week of January 30, 2017, which means new developments and disruptive changes should now be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.0-alpha1 will be released the week of July 31, 2017, which means new developments and disruptive changes should now be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.0-alpha1 will be released the week of January 17, 2018, which means new developments and disruptive changes should now be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.7.x-dev

Drupal 8.6.0-alpha1 will be released the week of July 16, 2018, which means new developments and disruptive changes should now be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

quietone credited cilefen.

quietone credited kratt.

quietone’s picture

quietone commented
Priority: Normal » Major
Issue summary: View changes
Issue tags: +Bug Smash Initiative

Closed #2878767: "The following module is missing from the file system" when specifying an invalid install profile as a query parameter as a duplicate, adding credit. Changing to Major based on the comment by cilefen in the duplicate.

quietone’s picture

quietone commented
Related issues: +#2878767: "The following module is missing from the file system" when specifying an invalid install profile as a query parameter

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

andypost’s picture

andypost
he/him
Primary language Russian
commented
Related issues: +#2940190: [meta] Deprecations of old functions in Extension system

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.