When running a security scanner against my site the module logs TypeError: count(): Argument #1 ($value) must be of type Countable|array, bool given in login_security_validate() (line 202 of /srv/www/html/modules/contrib/login_security/login_security.module) #0 [internal function]: login_security_validate(Array, Object(Drupal\Core\Form\FormState))
The scanner is still going, when it's done I'll have a look and see if I can figure out which form values are triggering this error. Possibly this is the same issue as #3143621: Validation function does not properly escape inputs when using preg_grep.
Run a fuzzer against the login form, check the logs.
Check the return value from preg_grep and handle it appropriately.
Write the fix.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | countable_error-3311976-1.patch | 815 bytes | trobey |
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #2
trobey commentedpreg_grep returns false if there are no matches, not an empty array.
Comment #3
trobey commentedComment #4
anybodyThanks @trobey - please use !empty() instead, which is fast and safe!
Comment #6
anybodyHere we go, see MR!
Comment #7
grevil commentedLGTM!
Comment #9
anybodyWill be part of 2.1.0! :)
Comment #10
anybody