Closed (fixed)
Project:
Micon - Icomoon.io Icon packages for Drupal
Version:
2.x-dev
Component:
Code
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
16 Sep 2021 at 07:45 UTC
Updated:
2 Aug 2022 at 08:49 UTC
Jump to comment: Most recent
Comments
Comment #2
anybodyMight be fixed with the schema changes in #3271002: Fix coding standards, add installation test and fix schema errors I guess?
@Grevil does this make sense to you?
Comment #3
grevil commentedNo, I don't think this has anything to do with the schema. The module is calling PCRE (Perl Compatible Regular Expression) functions during handling the font-awesome config yaml (fa) and somehow exceeds the backtrack_limit. This limit is apparently exceeded, when the match() function is called more than 1.000.000 times recursively, see here.
I don't know how this is exceeded and what the purpose of the fa.yml is for.
Comment #4
anybodyThank you @Grevil, indeed I overread that
message part.
Then I think we should postpone this on #3271162: Potential security risk using "unserialize" without limited allowed classes and #3271002: Fix coding standards, add installation test and fix schema errors as I think both are closely related and potentially fix this already.
Let's leave this open to report if someone else runs into this. As the issue is from 2021 it might also have been fixed already, I didn't run into it again yet.
Comment #5
anybodyJust experienced the same again with 2.0.0-beta3 on a project where micon definitely wasn't installed before. The message makes impossible to install the module.
Using Drupal 8.9
Comment #6
grevil commentedThis is quite the shot in the dark, but I still believe this error is related to the huge string in the fa.yml. Maybe try the patch from #3271162: Potential security risk using "unserialize" without limited allowed classes as the string gets deleted there (I think so, at least, it is really hard to read the patch).
Patch: https://www.drupal.org/files/issues/2022-03-28/micon_potential-security-...
Comment #7
grevil commentedI can confirm, that this issue is fixed in:
https://www.drupal.org/project/micon/issues/3271162
Comment #8
grevil commented