The FileValidationConstraintValidator might attempt to validate a file that does not exist. This happens for example when by a REST post you try to set an image reference "target_id" to one that does not exist.

CommentFileSizeAuthor
#8 interdiff.txt1.29 KBdinesh18
#8 2900675-8.patch1.29 KBdinesh18
validation-file_existance_check.patch1.05 KB_Archy_

Comments

_Archy_ created an issue. See original summary.

_Archy_’s picture

_Archy_ commented
Status: Active » Needs review

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.4.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Component: rest.module » file.module
Issue tags: +API-First Initiative

Great catch! This still needs test coverage though: a failing test to show that the current code does not cover this edge case. Then applying your patch should make the test pass.

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Issue tags: +Entity validation
eric115’s picture

eric115 commented

I'm not a big fan of declaring variables in logic operators for use outside of block-scope. What do you think about something like this for readability?

$file_target = $value->get('entity')->getTarget()

// The file might not exist. 
// In that case we will already have an invalid reference violation.
if (!$file_target) {
  return;
}

// Get the file to execute validators.
$file = $file_target->getValue();
// Get the validators.
$validators = $value->getUploadValidators();
borisson_’s picture

borisson_
Primary language Dutch
Location Mechelen, 🇧🇪
commented
Status: Needs review » Needs work
Issue tags: +Needs tests

Setting to needs work for the tests (#4), i also agree with #6.

dinesh18’s picture

dinesh18 commented
Status: Needs work » Needs review
StatusFileSize
new 2900675-8.patch1.29 KB
new interdiff.txt1.29 KB

Here is an updated patch and interdiff as per comment #6.
Still needs tests.

Status: Needs review » Needs work

The last submitted patch, 8: 2900675-8.patch, failed testing. View results

MHGR’s picture

MHGR commented

Hi,

I have same issue, While updating User Picture using REST by PATCH method, I have try to set "target_id":xx,
but I have got response like
{
"message": "Unprocessable Entity: validation failed.\nuser_picture.0.target_id: This entity (file: xx) cannot be referenced.\n"
}

any one help in this.

MHGR’s picture

MHGR commented
Status: Needs work » Active

Hi,

any one got solutions for this issue.

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.4 was released on January 3, 2018 and is the final full bugfix release for the Drupal 8.4.x series. Drupal 8.4.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.5.0 on March 7, 2018. (Drupal 8.5.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.5.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.6 was released on August 1, 2018 and is the final bugfix release for the Drupal 8.5.x series. Drupal 8.5.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.6.0 on September 5, 2018. (Drupal 8.6.0-rc1 is available for testing.)

Bug reports should be targeted against the 8.6.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.8.x-dev

Drupal 8.6.x will not receive any further development aside from security fixes. Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.2.x-dev

Drupal 8 is end-of-life as of November 17, 2021. There will not be further changes made to Drupal 8. Bugfixes are now made to the 9.3.x and higher branches only. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.2.x-dev » 9.3.x-dev
quietone’s picture

quietone commented
Status: Active » Closed (duplicate)
Issue tags: -Needs tests +Bug Smash Initiative
Related issues: +#2956814: FileValidationConstraintValidator assumes that the file exists

Looks like this was fixed in a later issue #2956814: FileValidationConstraintValidator assumes that the file exists.

Therefore, closing as a duplicate. If that is wrong, reopen the issue, by setting the status to 'Active', and add a comment.

Thanks!