Restrict access for autocomplete endpoint to logged in users

Problem/motivation

This issue was originally reported by a new Drupal user account, @hsjbrianwillows, with the title "linkit: anonymous username enumeration via unauthenticated autocomplete," submitted to the Drupal security team. The style of the analysis suggested LLM-based assistance, though there was no acknowledgement of this in the issue. The Drupal security team, in coordination with the Linkit maintainers, analyzed the report and concluded it did not qualify for a security advisory since user enumeration on its own does not represent a vulnerability per https://www.drupal.org/drupal-security-team/security-team-procedures/dis...

The maintainers of Linkit have decided to address this issue, regardless, having the work completed in the public issue queue.

The original analysis reads:

In linkit.routing.yml at lines 63-69, the autocomplete route has no authentication requirement:
linkit.autocomplete: with path: '/linkit/autocomplete/{linkit_profile_id}' and _access: 'TRUE'
The comment says "Access is handled by the matchers" but matchers only check entity-level view access, not authentication. The linkit Profile config entity loads successfully regardless of current user because the route parameter type resolution does not gate on administer linkit profiles.

Maintainer input: after review and testing, the comment "Access is handled by the matchers" is accurate as regards exposure of user information: the "User" matcher must explicitly be added to Linkit configuration; in other words, a generic site using Linkit with default configuration cannot expose usernames.

As a best practice measure, the maintainers have decided to add a check for authentication to the linkit autocomplete route, as this would further limit username enumeration in the scenario where a Linkit configuration has been set to expose usernames. This approach follows what Drupal core's system.entity_autocomplete route does.

There is an implication is this change: a Drupal form that is set up to be accessible by anonymous users, with a link field that uses the Linkit widget, will no longer be supported. Given that there is no realistic scenario where anonymous user forms should use Linkit, this implication seems acceptable.

The maintainers investigated adding a CSRF token as a requirement to the request, but the complexity involved in making this work with CKEditor's JS autocomplete functionality was deemed too great to justify this further step.

Proposed resolution

Add _user_is_logged_in: 'TRUE' to the linkit autocomplete route.