By wim leers on
Change record status: 
Published (View all published change records)
Project: 
Drupal core
Introduced in branch: 
8.6.x
Introduced in version: 
8.6.0
Issue links: 
https://www.drupal.org/node/1927648
Description: 

As part of enabling file uploads via the REST module (see the CR: https://www.drupal.org/node/2941420) for any format, we also ended up removing HAL's pre-existing denormalizer, \Drupal\hal\Normalizer\FileEntityNormalizer::denormalize().

The deleted code was:

  1. of highly questionable security, #1927648-507: Allow creation of file entities from binary data via REST requests said:
    1. The saving of the file to a temp location anyway is not really usable by the file entity properly
    2. No file validation at all. This means essentially any file of any type can be saved here. Security risk #1
    3. HTTP request is made to retrieve said file, this is Security risk #2 (and probably a good DDOS attack vector too)
  2. … unusable in the first place! Nobody could have been using it successfully anyway because HAL's denormalizers fail for file and image fields (see #1927648-498: Allow creation of file entities from binary data via REST requests)

The only place it could've been used was in PHP code calling the denormalizer: modules like https://www.drupal.org/project/default_content. They will need to be updated to use the thoroughly vetted, safer, scalable, thoroughly tested new upload mechanism described in https://www.drupal.org/node/2941420

Impacts: 
Module developers