Problem/Motivation

Noted by @avpaderno in Slack:

I saw modules using code similar to \Drupal::logger($channel)->addError($e->getMessage()); despite the first argument for addError() and other similar logger methods is supposed to be a literal string.

In some cases it's possible that the exception message contains user input, and even if this isn't the case, the message sent to the logger should be a translatable string; any variable strings should be passed in as context.

Steps to reproduce

Proposed resolution

PHPStan supports a literal-string data type, we should use this everywhere that literal strings are expected which would notify users of the API that they are doing something incorrect.

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

Issue fork drupal-3618704

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

longwave created an issue. See original summary.

longwave’s picture

Issue tags: +Security improvements

longwave-bot made their first commit to this issue’s fork.

longwave’s picture

Status: Active » Needs review
smustgrave’s picture

Before I mark does this need a CR since it's touching an interface?

smustgrave’s picture

Status: Needs review » Needs work
Issue tags: +Needs change record

Just to be safe could we add a CR? In case someones custom code out there has been using it incorrectly.

steinmb’s picture

Quick and rough draft https://www.drupal.org/node/3635549. Omitted any before after as I do not think we need one as we are not altering the behavior/signature.

Edit: English is not my first language.