InvalidArgumentException: Source path has to start with a slash. in Drupal\Core\Path\AliasManager->getAliasByPath() line 186 of core/lib/Drupal/Core/Path/AliasManager.php

Not sure if we still need an issue summary update, the steps are fairly clear.

Here's one approach with a test only patch. The test fails still because of another issue with the fix but it gets us closer...

Updated IS, removed irrelevant tags.

Fix for Warning: Undefined array key 1 template_preprocess_html()

The last submitted patch, 39: 3043779-39.patch, failed testing. View results →

The last submitted patch, 39: 3043779-39-test-only.patch, failed testing. View results →

The last submitted patch, 42: 3043779-42.patch, failed testing. View results →

Derp, should be a 404.

This is about the RequestPath condition.

The last submitted patch, 46: 3043779-46.patch, failed testing. View results →

The problem is more pervasive than this. If you visit /index.php5 (as mentioned in #30 🐛 "Source path has to start with a slash" exception when hitting path prefixed with index.php with RequestPath condition Needs work ), something takes everything after "index.php" as the path alias, and you end up in PathAlias.php with the path part set to "5" which throws an error, and 🐛 AliasManager->getAliasByPath('//') PHP Warning Needs work does not fix that.

I don't understand why the test passes but it doesn't work in my browser.

In my browser (or curl)

$ curl -SIl https://mysite.ddev.site/index.php5
HTTP/1.1 500 500 Service unavailable (with message)
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 18:37:53 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Cache-Control: must-revalidate, no-cache, private
X-UA-Compatible: IE=edge
Content-language: en
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Expires: Sun, 19 Nov 1978 05:00:00 GMT
X-Generator: Drupal 9 (https://www.drupal.org)

I kicked the test bot to test it here, and this test passes (ignore the unrelated test failures). So I ran it locally and it also passes:

$ phpunit modules/block/tests/src/Functional/BlockTest.php
PHPUnit 9.6.0 by Sebastian Bergmann and contributors.

Warning:       Your XML configuration validates against a deprecated schema.
Suggestion:    Migrate your XML configuration using "--migrate-configuration"!

Testing Drupal\Tests\block\Functional\BlockTest
..............                                                    14 / 14 (100%)

Time: 00:46.416, Memory: 6.00 MB

OK (14 tests, 247 assertions)

HTML output was generated

Sorry, I've isolated my particular problem to another module, so I'm restoring this to "needs review." Since this is a different (but similar problem) I'm not actually commenting on this patch.

The last submitted patch, 46: 3043779-46.patch, failed testing. View results →

This issue is reproducible in Drupal 10.1 also.

I have tried a patch for this issue in Drupal 10.1, this may resolved the mentioned problem. kindly review.

@priya.chat did you miss the previous patches? There's already ongoing work for this issue, with tests etc (see #46)

If that doesn't work for you, would you mind explaining what your solution does differently?

Hi @acbramley, I have tried previous patched for Drupal 10.1 , but didin't worked for me so I have given a try to first check if the path is valid for which we are validating the "/" value then apply the other checks. Thanks.

@priya.chat can you provide steps for how it's failing for you?

Can't drop test coverage though.

Hi @smustgrave , I have applied patch on #33 and tried to access /index.php5 or /index.php.php on Drupal 10.1.x , getting error below

InvalidArgumentException: Source path .php has to start with a slash. in Drupal\path_alias\AliasManager->getAliasByPath() (line 185 of /core/modules/path_alias/src/AliasManager.php).

Kindly suggest, if I am following any wrong step to reproduce this issue.

In my particular case, a visitor went to mysite.com/index.php) which causes a white screen error. #46 didn't work for me but #56 resolved the issue.

Rerolled #56 for 10.3. Applies cleanly and addresses the issue as described by making the change in path auto module for requiring a slash.

Reading the thread again, I've moved the initial test from #39 into the patch from #56 rerolled in #60 into this patch, #61.

Patch in #61 worked well for me on 10.3. Thanks!

The last patch couldn't be applied to Drupal 10.3.9.

Here is a reroll.

When updating to Drupal 11.1.3 while this patch is installed, clearing cache for the first time (the first of our post-deployment steps), the following error happens. Removing the patch allows cache to be cleared, and it can be added back. I think a check for an empty or unset whitelist will fix this. If so, I'll update the patch.

Error: Call to a member function get() on null in /var/www/html/docroot/core/modules/path_alias/src/AliasManager.php on line 149 #0 /var/www/html/docroot/core/modules/path_alias/src/PathProcessor/AliasPathProcessor.php(47): Drupal\path_alias\AliasManager->getAliasByPath()
#1 /var/www/html/docroot/core/lib/Drupal/Core/PathProcessor/PathProcessorManager.php(108): Drupal\path_alias\PathProcessor\AliasPathProcessor->processOutbound()
#2 /var/www/html/docroot/core/lib/Drupal/Core/Routing/UrlGenerator.php(392): Drupal\Core\PathProcessor\PathProcessorManager->processOutbound()
#3 /var/www/html/docroot/core/lib/Drupal/Core/Routing/UrlGenerator.php(294): Drupal\Core\Routing\UrlGenerator->processPath()
#4 /var/www/html/docroot/core/lib/Drupal/Core/Render/MetadataBubblingUrlGenerator.php(105): Drupal\Core\Routing\UrlGenerator->generateFromRoute()
#5 /var/www/html/docroot/core/lib/Drupal/Core/Url.php(769): Drupal\Core\Render\MetadataBubblingUrlGenerator->generateFromRoute()
#6 /var/www/html/docroot/modules/contrib/webform/src/WebformHelpManager.php(1613): Drupal\Core\Url->toString()
#7 /var/www/html/docroot/modules/contrib/webform/src/WebformHelpManager.php(146): Drupal\webform\WebformHelpManager->initHelp()
#8 /var/www/html/docroot/core/lib/Drupal/Component/DependencyInjection/Container.php(259): Drupal\webform\WebformHelpManager->__construct()
#9 /var/www/html/docroot/core/lib/Drupal/Component/DependencyInjection/Container.php(177): Drupal\Component\DependencyInjection\Container->createService()
#10 /var/www/html/vendor/drush/drush/src/Runtime/LegacyServiceInstantiator.php(289): Drupal\Component\DependencyInjection\Container->get()
#11 /var/www/html/vendor/drush/drush/src/Runtime/LegacyServiceInstantiator.php(253): Drush\Runtime\LegacyServiceInstantiator->resolveFromContainer()
#12 [internal function]: Drush\Runtime\LegacyServiceInstantiator->resolveArgument()
#13 /var/www/html/vendor/drush/drush/src/Runtime/LegacyServiceInstantiator.php(223): array_map()
#14 /var/www/html/vendor/drush/drush/src/Runtime/LegacyServiceInstantiator.php(193): Drush\Runtime\LegacyServiceInstantiator->resolveArguments()
#15 /var/www/html/vendor/drush/drush/src/Runtime/LegacyServiceInstantiator.php(167): Drush\Runtime\LegacyServiceInstantiator->instantiateObject()
#16 /var/www/html/vendor/drush/drush/src/Runtime/LegacyServiceInstantiator.php(117): Drush\Runtime\LegacyServiceInstantiator->create()
#17 /var/www/html/vendor/drush/drush/src/Runtime/LegacyServiceInstantiator.php(54): Drush\Runtime\LegacyServiceInstantiator->instantiateServices()
#18 /var/www/html/vendor/drush/drush/src/Boot/DrupalBoot8.php(242): Drush\Runtime\LegacyServiceInstantiator->loadServiceFiles()
#19 /var/www/html/vendor/drush/drush/src/Boot/DrupalBoot8.php(218): Drush\Boot\DrupalBoot8->addDrupalModuleDrushCommands()
#20 /var/www/html/vendor/drush/drush/src/Boot/BootstrapManager.php(211): Drush\Boot\DrupalBoot8->bootstrapDrupalFull()
#21 /var/www/html/vendor/drush/drush/src/Boot/BootstrapManager.php(397): Drush\Boot\BootstrapManager->doBootstrap()
#22 /var/www/html/vendor/drush/drush/src/Application.php(219): Drush\Boot\BootstrapManager->bootstrapMax()
#23 /var/www/html/vendor/drush/drush/src/Application.php(185): Drush\Application->bootstrapAndFind()
#24 /var/www/html/vendor/symfony/console/Application.php(284): Drush\Application->find()
#25 /var/www/html/vendor/symfony/console/Application.php(193): Symfony\Component\Console\Application->doRun()
#26 /var/www/html/vendor/drush/drush/src/Runtime/Runtime.php(110): Symfony\Component\Console\Application->run()
#27 /var/www/html/vendor/drush/drush/src/Runtime/Runtime.php(40): Drush\Runtime\Runtime->doRun()
#28 /var/www/html/vendor/drush/drush/drush.php(140): Drush\Runtime\Runtime->run()
#29 /var/www/html/vendor/bin/drush.php(119): include('...')
#30 {main}
Error: Call to a member function get() on null in Drupal\path_alias\AliasManager->getAliasByPath() (line 149 of /var/www/html/docroot/core/modules/path_alias/src/AliasManager.php).
 [warning] Drush command terminated abnormally.
Failed to run drush cr: exit status 1

$whitelist was changed to $pathPrefixes in Drupal 11.1.0

https://git.drupalcode.org/project/drupal/-/commit/27948b069b1be0be6062b...

Here is an updated patch for Drupal 11.1+.

This needs to be rolled onto an MR.

I am running into this being flagged by Invicti/Netsparker scan because they try to hit nonsensical pages like

• /index.php.
• /index.php.?hTTp://r87.com/n
• /index.phpI-dont-exist
• /index.php.php/some/path

And Invicti objects to getting a 500 response instead of a more appropriate 404. I agree with desoi, acbramley and alexpott who suggested this should be a 404. Sites with a 500 error look broken and it should not be this easy to make a Drupal site look broken.

alexpott indicated there was a possible problem with 404 ing in this case. I wonder if instead of trying to handle this at the php level and replacing the thrown exception with a 404, if it would be cleaner to have a well crafted rule in .htaccess that handles the non slash characters after `index.php`

I created a new branch and PR ^^ for an .htaccess approach to the problem. It is simpler, and since most sites customize their .htaccess anyway, this would allow them to alter it without really needing to patch core.

While the Tugboat is available, this url should return fine
https://mr11806-gs7qqwaidh3locbz5vsd5vt5golwwmyn.tugboatqa.com/index.php

And this one should result in 404
https://mr11806-gs7qqwaidh3locbz5vsd5vt5golwwmyn.tugboatqa.com/index.phpboo

It could be useful to potentially have both the php and htaccess fixes.