This was originally reported as a private security issue. However, it is cleared by the security team to handle as a public issue since we have 6.x alpha release.
Currently $in $out and $file doesn't have variable type defained.
This might cause issues if any arbitrary object or variable is passed in $file.
N/A
Add variable type hinting
Added a MR
Needs review
N/A
N/A
N/A
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #3
mohit_aghera commented