Url::access() doesn't allow cacheability metadata to be bubbled

Created on 29 February 2016, almost 9 years ago
Updated 30 January 2023, almost 2 years ago

Problem/Motivation

Url::access() doesn't bubble cacheability metadata, and consequently could lead to security vulnerabilities in case developers fail to take this into account.

See #2661200-52: Make admin/help page more flexible, and list tours on it β†’ 's interdiff-url-changes.txt for an initial patch.

Proposed resolution

Make it bubble cacheability metadata.

Remaining tasks

TBD

User interface changes

None.

API changes

TBD

Data model changes

None.

πŸ› Bug report
Status

Needs work

Version

10.1 ✨

Component
RoutingΒ  β†’

Last updated 1 day ago

Created by

πŸ‡§πŸ‡ͺBelgium wim leers Ghent πŸ‡§πŸ‡ͺπŸ‡ͺπŸ‡Ί

Live updates comments and jobs are added and updated live.
  • Security improvements

    It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.

Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • The Needs Review Queue Bot β†’ tested this issue. It either no longer applies to Drupal core, or fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".

    Apart from a re-roll or rebase, this issue may need more work to address feedback in the issue or MR comments. To progress an issue, incorporate this feedback as part of the process of updating the issue. This helps other contributors to know what is outstanding.

    Consult the Drupal Contributor Guide β†’ to find step-by-step guides for working with issues.

Production build 0.71.5 2024