Problem/Motivation

Follow-up from #3239761-16: Fix MimeTypeTest to prevent deprecations in PHP 8.1 and fix \Drupal\Core\StreamWrapper\PrivateStream::basePath() documentation

Steps to reproduce

The \Drupal\Core\StreamWrapper\PrivateStream::getDirectoryPath() could get NULL from basepath() method as #3239761: Fix MimeTypeTest to prevent deprecations in PHP 8.1 and fix \Drupal\Core\StreamWrapper\PrivateStream::basePath() documentation documents

Proposed resolution

throw exception to prevent access to / (root file system) when accessing non configured private files

Remaining tasks

review, patch, commit

User interface changes

tbd

API changes

tbd

Data model changes

no

Release notes snippet

tbd

Comments

andypost created an issue. See original summary.

alexpott’s picture

In \Drupal\Core\CoreServiceProvider::register() we do...

    // Only register the private file stream wrapper if a file path has been set.
    if (Settings::get('file_private_path')) {
      $container->register('stream_wrapper.private', 'Drupal\Core\StreamWrapper\PrivateStream')
        ->addTag('stream_wrapper', ['scheme' => 'private']);
    }

Therefore the code that relies on \Drupal\Core\StreamWrapper\PrivateStream::getDirectoryPath() reasonably expected this to return a string. If the private stream wrapper is incorrectly registered prior to the file_private_path being set we should throw a logic exception since it is just not supposed to work this way.

Also we could consider changing
Settings::get('file_private_path') to \Drupal\Core\StreamWrapper\PrivateStream::basePath()
Settings::get('file_public_path') to \Drupal\Core\StreamWrapper\PublicStream::basePath()
We could save some duplicated code in system_requirements() and have less hard-coded strings lying about.

andypost’s picture

Thank for great idea, just checked usage and it's clear that file_private_path expected as empty string by default

sites/default/default.settings.php:506:# $settings['file_private_path'] = '';
alexpott’s picture

@andypost well that's commented out - so by default it is not set :) i.e NULL. And it is not set by the installer.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

andypost’s picture

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.