Recently I found that when checking if the path is valid PathProcessor uses getUrlIfValidWithoutAccessCheck.
If you check the documentation of PathValidatorInterface, it says:
Unlike getUrlIfValid(), access check is not performed. Do not use this method if the $path is about to be presented to a user.
I have a question why this method is being used instead of getUrlIfValid() that has access check? The module is expected to present the path to any user, including anonymous.
Postponed
1.0
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
Not access checking doesn't smell right to me. *but* I'm very not confident that it wouldn't have an unforeseen impact. I won't commit this without other people weighing in and testing various use cases manually. Have some automated tests for it other than just not breaking the existing tests would be ideal but that might not really be easy either.