Problem/Motivation

UrlResolver::discoverResourceUrl is called as part of the public method getProviderByUrl. The method makes an HTTP GET request to the provided URL, and tries to parse the response body as HTML. But nowhere does it check the type of response, via the Content-Type header. That means it can try to erroneously parse non-HTML contents as HTML.

Steps to reproduce

Call UrlResolver::getProviderByUrl with a URL that does not return HTML.

Proposed resolution

Check the Content-Type headers before parsing as HTML.

Remaining tasks

User interface changes

n/a

Introduced terminology

API changes

n/a

Data model changes

n/a

Release notes snippet

Issue fork drupal-3568922

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

alecsmrekar created an issue. See original summary.

alecsmrekar’s picture

Assigned: alecsmrekar » Unassigned
Status: Active » Needs review
moshe weitzman’s picture

Status: Needs review » Reviewed & tested by the community

LGTM. Thanks for the test.

  • longwave committed f8428ec0 on 11.x
    fix: #3568922 Method discoverResourceUrl does not check response type...

  • longwave committed 014cc526 on main
    fix: #3568922 Method discoverResourceUrl does not check response type...
longwave’s picture

Version: main » 11.x-dev
Status: Reviewed & tested by the community » Fixed

As a minor behaviour change let's only commit this to the next minor - there is an outside chance this was working before for some sites even with an incorrect or missing content type.

Committed and pushed 014cc526536 to main and f8428ec0b6b to 11.x. Thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.