ToolbarController::preRenderGetRenderedSubtrees() deletes parent's cacheability.

Created on 18 September 2019, over 5 years ago
Updated 11 April 2023, over 1 year ago

ToolbarController::preRenderGetRenderedSubtrees() instantiates a new $cacheability variable which it populates in a loop and then applies to the parent render array. The problem is that this new instance does not have the parent's cacheability and therefore might delete crucial cache contexts.

Instead of using a blank CaheableMetadata, an instance should be created from the parent render array like so:

    $cacheability = CacheableMetadata::createFromRenderArray($data);

Marking as major because in some edge cases I can't come up with this might lead to data exposure. Not filing as a security issue because 8.8.0 isn't out yet.

πŸ› Bug report
Status

Fixed

Version

9.5

Component
ToolbarΒ  β†’

Last updated about 1 month ago

  • Maintained by
  • πŸ‡«πŸ‡·France @nod_
Created by

πŸ‡§πŸ‡ͺBelgium kristiaanvandeneynde Antwerp, Belgium

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024