By kim.pepper on
Change record status: 
Published (View all published change records)
Project: 
Drupal core
Introduced in branch: 
12.1.x
Introduced in version: 
12.1.0
Issue links: 
https://www.drupal.org/node/3218381
Description: 

\Drupal\file\Element\ManagedFile::valueCallback() now validates #file_value_callbacks entries the same way core validates #process, #pre_render, and other render callbacks.

Previously, #file_value_callbacks executed any callable directly, bypassing the protections added by #2966327: Limit what can be called by a callback in render arrays to reduce the risk of RCE. This allowed arbitrary code execution if untrusted input reached this property.

Each callback must now be one of:

  • A method tagged with the \Drupal\Core\Security\Attribute\TrustedCallback attribute.
  • A method of a class implementing \Drupal\Core\Security\TrustedCallbackInterface, listed in trustedCallbacks().
  • An anonymous function.

A callback that meets none of these throws \Drupal\Core\Security\UntrustedCallbackException.

Update any code that sets #file_value_callbacks to use one of these approaches.

Impacts: 
Module developers