I am seeing a flood of these PHP notices in my Recent Log Messages:

Notice: Array to string conversion in Drupal\libraries_cdn\Type\CDNBase->Drupal\libraries_cdn\Type\{closure}() (line 218 of .../libraries_cdn/src/Type/CDNBase.php).

They occur on every pageload many many times.

Upon closer inspection, it looks like the $v variable is sometimes a string and sometimes an array. The code on line 218 assumes it is always a string (it concatenates it to another string). Here's what the code looks like, for quick reference:

  /**
   * {@inheritdoc}
   */
  public function convertFiles(array $files, $version) {
    $url = $this->getURL(__FUNCTION__);
    return array_map(function($v) use ($url, $version) {
      return sprintf($url, $this->getLibrary(), $version) . $v;
    }, $files);
  }

If I dpm($v); on my site, it looks like sometimes it is a string that contains the name of a library file to load, and other times it is an array in the following form:

array(
  'name' => 'ol-debug.js',
  'integrity' => 'sha256-Ye0VjmSihS0WHaLTveqwKv4CsaBakp84TGIpQUK/ef4=',
)

I then searched (via grep) for "integrity" in libraries_cdn and openlayers modules, but neither turned up any occurrences. So I'm not sure where that "integrity" array key is coming from.

I tried simply changing line 218 to:

return sprintf($url, $this->getLibrary(), $version) . $v['name'];

... That fixes most of the notices, but creates new ones:

Warning: Illegal string offset 'name' in Drupal\libraries_cdn\Type\CDNBase->Drupal\libraries_cdn\Type\{closure}() (line 218 of .../libraries_cdn/src/Type/CDNBase.php).

That's because $v is only SOMETIMES an array - and other times it is a string, as expected.

So I'm not sure what's up! Any ideas?

Comments

m.stenta created an issue. See original summary.

m.stenta’s picture

Status: Active » Closed (cannot reproduce)

WHAT?! Now it's not happening anymore! Maybe I'm going crazy...

Or maybe this has something to do with information that is returned from one of the CDNs? (jsDelivr or CDNJS)

Perhaps they are adding the "integrity" variable? I wonder why it was happening for a while and then stopped. Maybe a bug on their end?

I will close this for now, but if I see it again we can take another look...

pol’s picture

Never saw that either :(

Weird...

pol’s picture

Status: Closed (cannot reproduce) » Active

Hi,

I think this is related to: https://hacks.mozilla.org/2015/09/subresource-integrity-in-firefox-43/
Cloudflare is testing the feature. Looks like I will have to update the module soon.
If you found a way to reproduce it, let me know, it could speed up things on my side.

Thanks!

m.stenta’s picture

Hmm interesting. I like the idea of integrity signatures - but it's sort of funny that CDNs would include the signature with the files. If you are using that signature to test against, then anyone who has compromised the CDN could have also compromised the signature.

But anyway, that's a separate issue (and far outside the scope of this module).

I didn't really have to do anything to reproduce - I just have Openlayers and Libraries CDN installed - and I noticed a lot of PHP Notices in my Recent Log Messages. But it seemed to stop on it's own... so I think it has something to do with the data received from the CDNs about the files. Sometimes it's just a string filename, and sometimes (when the issue is present) it's an associative array with a 'name' and 'integrity' key.

pol’s picture

Status: Active » Closed (cannot reproduce)