Limit what can be called by a callback in form arrays

Created on 27 April 2018, over 6 years ago
Updated 23 April 2023, over 1 year ago

Problem/Motivation

Recent security releases have shown that the render system needs to be stricter about what it allow to be called by a callback. See:

Form list of callbacks to target:

  • βœ“ #process
  • βœ“ #after_build
  • βœ“ #value_callback
  • βœ“ #element_validate
  • βœ“ #validate
  • #submit
  • #date_date_callbacks
  • #entity_builders
  • #file_value_callbacks

Proposed resolution

Postponed on the render system solution - #2966327: Limit what can be called by a callback in render arrays to reduce the risk of RCE β†’ - once we have an agreed solution there we should largely copy it.

  1. In 8.8.x deprecate the ability to call any function using call_user_func*() and limit to object implementing FormCallback interface, FormElementInterface or a closure. For objects also limit to specific methods to further narrow the surface area.
  2. Try and provide a PHPCS fix that can auto-update code?
  3. In 9.0.x remove the ability.

Remaining tasks

Discuss solutions.

User interface changes

None

API changes

Yes

Data model changes

None.

πŸ“Œ Task
Status

Active

Version

10.1 ✨

Component
FormΒ  β†’

Last updated 5 days ago

Created by

πŸ‡¬πŸ‡§United Kingdom alexpott πŸ‡ͺπŸ‡ΊπŸŒ

Live updates comments and jobs are added and updated live.
  • Security improvements

    It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.

  • Needs change record

    A change record needs to be drafted before an issue is committed. Note: Change records used to be called change notifications.

Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024