Route is sometimes NULL in CsrfExceptionSubscriber

Changing tags per Issue tags field and Issue tags -- special tags

patch to fix for drupal 10.3.x

works for me

thanks in advance

Fixed need to be in MRs.

Also this will need steps to reproduce and probably test coverage

refs to steps

I had an error when trying to replace 404 response with 403 response for some cases.
e.g. when a user tries to access /user/2 page, but user 2 was removed.

to replace the response, I used an event subscriber with $events[KernelEvents::EXCEPTION] event
with a callback smth like :

if ($event->getThrowable() instanceof NotFoundHttpException && 'user/2' == $path) {
  $event->setThrowable(new AccessDeniedHttpException());
}

This can happen when you throw an Access Denied exception from a URL that doesn't have a route. That can happen if you write a module that triggers this during an event subscriber. The premises in the original code, that such an exception must only occur when the current page is routed is too strict.

I'm also frequently seeing that, easily repeatable when hammering server with e2e tests, but triggered by different paths. Patch seems to work for me.

Still needs steps added to the summary

I've added a module that can easily reproduce the crash. It happens as soon as some module triggers an AccessDeniedHttpException before a route is established or on pages that don't even have a route. My example just blocks access to all pages which URL ends with /crash. Of course this is arbitrary. It could be a module that wants to deny access on specific date ranges etc. The error message from the original issue description points to a ban module. I don't use that module myself, but I expect that it somehow bans or blocks access depending on IP etc. This is basically the same thing. As soon as that module intercepts a page request via EventSubscriber onKernelRequest and triggers an AccessDeniedHttpException in specific cases, the error appears. As I've already explained, the premesis that a route always exists whenever an AccessDeniedHttpException is triggered is incorrect. The fix/patch is obviously easy and has already been proposed here above.

Thanks for providing an example, but typically the steps are more basic for how this is triggered in just core.

But fixes should be in MRs and bugs will need test coverage showing the issue.

@smustgrave: I'm unsure on how to proceed here. It's quite a dilemma. The error can't be triggered with core alone. It can only be triggered with an additional event subscriber. But the existence of this bug prevents any modules from being able to throw AccessDeniedExceptions in EventSubcriber.

Ah, I just saw the ban module is part of core. We have this:

  public function handle(Request $request, $type = self::MAIN_REQUEST, $catch = TRUE): Response {
    $ip = $request->getClientIp();
    if ($this->banIpManager->isBanned($ip)) {
      return new Response(new FormattableMarkup('@ip has been banned', ['@ip' => $ip]), 403);
    }
    return $this->httpKernel->handle($request, $type, $catch);
  }

The error will probably appear as soon as isBanned() returns true. So we would need a test that simulates a banned IP and then this error will appear...

Thinking again, I discovered the ban module is about to be moved out of core and this issue doesn't really have anything to do with it. It therefore doesnt make sense to base any testing on the ban module either. I've filed a new issue #3566351 as feature request. I'll see whether I can manage to create a test for core. I've never written one, so it might be a bit difficult.

Just ran into this myself and #12 is right.

We have this on a jsonapi resource (which is core code) and a custom AuthenticationProviderInterface throwing an AccessDeniedHttpException. The jsonapi resource does not seem to add a route object to the request, which leads to the error in the IS.

Updating the component as per #14 and #16 this is not specific to ban.module

Looking at 'main' branch there is now an is_null($route) via #3566351: Throwing AccessDeniedException without a route causes PHP errors