The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Problem/Motivation
There were some poking around on our site and they were looking for security holes. This is related to #3378487: Validating String Encodings Before Insert but for a specific probe that I think we can solve.
Steps to reproduce
- Setup a multi-select exposed taxonomy filter in a View (ajax turned on but I don't think that is needed?)
- Pass in a multi-dimensional array through the get arg: https://site.test/news?tags%5B0%5D%5B0%5D=4933
Proposed resolution
Check if the value is scalar.
Remaining tasks
User interface changes
(New or changed features/functionality in the user interface, modules added or removed, changes to URL paths, changes to user interface text.)
API changes
None
Data model changes
None
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | Screenshot 2024-05-16 at 17.07.11.png | 694.38 KB | joelpittet |
Issue fork drupal-3447748
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
- 3447748-typeerror-illegal-offset
changes, plain diff MR !8104
Comments
Comment #2
joelpittetComment #3
joelpittetI realize this will need tests.
Comment #5
smustgrave commentedMR appears to have failures
Most cases of tickets like these (illegal offset types) I've seen recommendations to backtrace to the point where it's suppose to be scarlar. To make sure we aren't masking a larger issue. But is possible this could be the correct approach in this case.
Comment #6
joelpittet@smustgrave Thanks for taking a look. I believe this is correct in this case but thanks for checking. This case I know the user-input is the source of the problem which is in the issue summary. FYI it looks like this
?tags[0][0]to help read the URL encoding above.This problem is discrete but part of a bigger set of attack vectors in the parent.
If you could point to a place where I can add a test case, that would really help me out. Otherwise I will take a horrible guess...
Comment #7
joelpittetComment #8
smustgrave commentedThere's Drupal\Tests\Core\Form\FormValidatorTest we could probably expand on
Also can you rebase? I believe that random failure is fixed on head.
Comment #10
ramil g commentedAdded the test.
Comment #11
joelpittetThanks for adding a test to prove the problem exists and fixing my typo!
Comment #12
alexpottCommitted and pushed b3ad358039 to 11.x and a0e23a634f to 11.0.x and 48de87ec1b to 10.4.x and f323ffae3d to 10.3.x. Thanks!
This replaces an error with a better message and a user can cause this with a crafted URL so this is a nice improvement. Backported to 10.3.x as a non-disruptive bugfix.