Limit what can be called by a callback in form arrays

Created on 27 April 2018, about 6 years ago
Updated 14 April 2024, 2 months ago

Problem/Motivation

Recent security releases have shown that the render system needs to be stricter about what it allow to be called by a callback. See:

Form list of callbacks to target:

  • βœ“ #process
  • βœ“ #after_build
  • βœ“ #value_callback
  • βœ“ #element_validate
  • βœ“ #validate
  • #submit

Proposed resolution

Postponed on the render system solution - #2966327: Limit what can be called by a callback in render arrays to reduce the risk of RCE β†’ - once we have an agreed solution there we should largely copy it.

  1. In 10.3.x deprecate the ability to call any function using call_user_func*() and limit to object implementing FormCallback interface, FormElementInterface or a closure. For objects also limit to specific methods to further narrow the surface area.
  2. Try and provide a PHPCS fix that can auto-update code?
  3. In 11.0.x remove the ability.

Remaining tasks

  1. Refactor all the prior refactoring done against 9.2 against 10.3.x using the new attribute.
  2. Find any additional callbacks added since 9.2 and refactor those.

User interface changes

None

API changes

Yes

Data model changes

None.

πŸ“Œ Task
Status

Needs work

Version

11.0 πŸ”₯

Component
FormΒ  β†’

Last updated about 7 hours ago

Created by

πŸ‡¬πŸ‡§United Kingdom alexpott πŸ‡ͺπŸ‡ΊπŸŒ

Live updates comments and jobs are added and updated live.
  • Security improvements

    It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.

  • Needs change record

    A change record needs to be drafted before an issue is committed. Note: Change records used to be called change notifications.

Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.69.0 2024