Problem/Motivation

This is a public follow-up to add tests for SA-CORE-2025-005.

These updates were provided by @larowlan, @alexpott, and @poker10 in the security team issue https://git.drupalcode.org/security/28-drupal-security/-/issues/1.

Release notes snippet

Update tests for cache poisoning protection

Issue fork drupal-3570173

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

akalata created an issue. See original summary.

akalata opened merge request !14535

akalata’s picture

akalata commented
Assigned: akalata » Unassigned
Status: Active » Needs review
smustgrave’s picture

smustgrave commented
Status: Needs review » Reviewed & tested by the community
Issue tags: +Needs Review Queue Initiative

Reverted the commit https://git.drupalcode.org/project/drupal/-/commit/8f3154bd9badd52ecf626...

Ran the tests

Failed asserting that 200 is identical to 400.
/var/www/html/core/tests/Drupal/FunctionalTests/HttpKernel/RequestSanitizerTest.php:57

The other test the following failed: GET, HEAD, OPTIONS, and TRACE

Believe test coverage is good

longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Version: main » 11.x-dev
Status: Reviewed & tested by the community » Fixed

Added credits for the code authors from the security issue, and for @smustgrave for providing test results above.

Committed and pushed f98362ad91b to main and b0a5990c537 to 11.x. Thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • longwave committed b0a5990c on 11.x 
    test: #3570173 Update tests for cache poisoning protection

By: akalata...

longwave closed merge request !14535

  • longwave committed f98362ad on main 
    test: #3570173 Update tests for cache poisoning protection

By: akalata...
xjm’s picture

xjm
she/her
Primary language English
commented

Added some credits that were missed from the original (pre-MR) private issue. Thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.