Protect pager against [] for the page

Created on 28 May 2020, about 4 years ago
Updated 28 December 2023, 6 months ago

Problem/Motivation

The warning occurs during every use of the pager.parameters service and when the GET query is not page=1 but something array-like, e.g. page[]=1.

This sort of query can easily happen due to bugs in javascript or triggered by automated scanners.

Steps to reproduce

Visit a page with a pager, like the recipe page in umami, and add the query argument page[]=1

This will trigger the following exception in the watchdog:

Symfony\Component\HttpKernel\Exception\BadRequestHttpException: Input value "page" contains a non-scalar value. in Symfony\Component\HttpKernel\HttpKernel->handle() (line 83 of /app/vendor/symfony/http-kernel/HttpKernel.php).

This is triggered by a previous exception that has a stack trace/signature similar to this from the original report:

Warning: explode() expects parameter 2 to be string, array given in Drupal\Core\Pager\PagerParameters->getPagerQuery() (line 58 of /home/catuser/app/public/docroot/core/lib/Drupal/Core/Pager/PagerParameters.php)
#0 /home/catuser/app/public/docroot/core/includes/bootstrap.inc(600): _drupal_error_handler_real(2, 'explode() expec...', '/home/catuser/a...', 58, Array)
#1 [internal function]: _drupal_error_handler(2, 'explode() expec...', '/home/catuser/a...', 58, Array)
#2 /home/catuser/app/public/docroot/core/lib/Drupal/Core/Pager/PagerParameters.php(58): explode(',', Array)
#3 /home/catuser/app/public/docroot/core/lib/Drupal/Core/Pager/PagerParameters.php(49): Drupal\Core\Pager\PagerParameters->getPagerQuery()
#4 /home/catuser/app/public/docroot/core/lib/Drupal/Core/Pager/PagerManager.php(49): Drupal\Core\Pager\PagerParameters->findPage(0)
#5 /home/catuser/app/public/docroot/core/modules/views/src/Plugin/views/pager/SqlBase.php(341): Drupal\Core\Pager\PagerManager->createPager('1470', 25, 0)
#6 /home/catuser/app/public/docroot/core/modules/views/src/ViewExecutable.php(1422): Drupal\views\Plugin\views\pager\SqlBase->updatePageInfo()
#7 /home/catuser/app/public/docroot/core/modules/views/src/ViewExecutable.php(1454): Drupal\views\ViewExecutable->execute(NULL)
#8 /home/catuser/app/public/docroot/core/modules/rest/src/Plugin/views/display/RestExport.php(441): Drupal\views\ViewExecutable->render()
#9 /home/catuser/app/public/docroot/core/modules/views/src/ViewExecutable.php(1630): Drupal\rest\Plugin\views\display\RestExport->execute()
#10 /home/catuser/app/public/docroot/core/modules/views/src/Element/View.php(77): Drupal\views\ViewExecutable->executeDisplay('json_seo_dashbo...', Array)
#11 [internal function]: Drupal\views\Element\View::preRenderViewElement(Array)
#12 /home/catuser/app/public/docroot/core/lib/Drupal/Core/Security/DoTrustedCallbackTrait.php(100): call_user_func_array(Array, Array)
#13 /home/catuser/app/public/docroot/core/lib/Drupal/Core/Render/Renderer.php(781): Drupal\Core\Render\Renderer->doTrustedCallback(Array, Array, 'Render #pre_ren...', 'silenced_deprec...', 'Drupal\\Core\\Ren...')
#14 /home/catuser/app/public/docroot/core/lib/Drupal/Core/Render/Renderer.php(372): Drupal\Core\Render\Renderer->doCallback('#pre_render', Array, Array)
#15 /home/catuser/app/public/docroot/core/lib/Drupal/Core/Render/Renderer.php(200): Drupal\Core\Render\Renderer->doRender(Array, true)
#16 /home/catuser/app/public/docroot/core/lib/Drupal/Core/Render/Renderer.php(144): Drupal\Core\Render\Renderer->render(Array, true)
#17 /home/catuser/app/public/docroot/core/lib/Drupal/Core/Render/Renderer.php(573): Drupal\Core\Render\Renderer->Drupal\Core\Render\{closure}()
#18 /home/catuser/app/public/docroot/core/lib/Drupal/Core/Render/Renderer.php(145): Drupal\Core\Render\Renderer->executeInRenderContext(Object(Drupal\Core\Render\RenderContext), Object(Closure))
#19 /home/catuser/app/public/docroot/core/modules/rest/src/Plugin/views/display/RestExport.php(424): Drupal\Core\Render\Renderer->renderRoot(Array)
#20 /home/catuser/app/public/docroot/core/modules/views/src/Routing/ViewPageController.php(54): Drupal\rest\Plugin\views\display\RestExport::buildResponse('url_list', 'json_seo_dashbo...', Array)
#21 [internal function]: Drupal\views\Routing\ViewPageController->handle('url_list', 'json_seo_dashbo...', Object(Drupal\Core\Routing\RouteMatch))
#22 /home/catuser/app/public/docroot/core/lib/Drupal/Core/EventSubscriber/EarlyRenderingControllerWrapperSubscriber.php(123): call_user_func_array(Array, Array)
#23 /home/catuser/app/public/docroot/core/lib/Drupal/Core/Render/Renderer.php(573): Drupal\Core\EventSubscriber\EarlyRenderingControllerWrapperSubscriber->Drupal\Core\EventSubscriber\{closure}()
#24 /home/catuser/app/public/docroot/core/lib/Drupal/Core/EventSubscriber/EarlyRenderingControllerWrapperSubscriber.php(124): Drupal\Core\Render\Renderer->executeInRenderContext(Object(Drupal\Core\Render\RenderContext), Object(Closure))
#25 /home/catuser/app/public/docroot/core/lib/Drupal/Core/EventSubscriber/EarlyRenderingControllerWrapperSubscriber.php(97): Drupal\Core\EventSubscriber\EarlyRenderingControllerWrapperSubscriber->wrapControllerExecutionInRenderContext(Array, Array)
#26 /home/catuser/app/public/vendor/symfony/http-kernel/HttpKernel.php(151): Drupal\Core\EventSubscriber\EarlyRenderingControllerWrapperSubscriber->Drupal\Core\EventSubscriber\{closure}()
#27 /home/catuser/app/public/vendor/symfony/http-kernel/HttpKernel.php(68): Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object(Symfony\Component\HttpFoundation\Request), 1)
#28 /home/catuser/app/public/docroot/core/lib/Drupal/Core/StackMiddleware/Session.php(57): Symfony\Component\HttpKernel\HttpKernel->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#29 /home/catuser/app/public/docroot/core/lib/Drupal/Core/StackMiddleware/KernelPreHandle.php(47): Drupal\Core\StackMiddleware\Session->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#30 /home/catuser/app/public/docroot/core/modules/page_cache/src/StackMiddleware/PageCache.php(106): Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#31 /home/catuser/app/public/docroot/core/modules/page_cache/src/StackMiddleware/PageCache.php(85): Drupal\page_cache\StackMiddleware\PageCache->pass(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#32 /home/catuser/app/public/vendor/asm89/stack-cors/src/Asm89/Stack/Cors.php(49): Drupal\page_cache\StackMiddleware\PageCache->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#33 /home/catuser/app/public/docroot/core/lib/Drupal/Core/StackMiddleware/ReverseProxyMiddleware.php(47): Asm89\Stack\Cors->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#34 /home/catuser/app/public/docroot/core/lib/Drupal/Core/StackMiddleware/NegotiationMiddleware.php(52): Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#35 /home/catuser/app/public/vendor/stack/builder/src/Stack/StackedHttpKernel.php(23): Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#36 /home/catuser/app/public/docroot/core/lib/Drupal/Core/DrupalKernel.php(708): Stack\StackedHttpKernel->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#37 /home/catuser/app/public/docroot/index.php(19): Drupal\Core\DrupalKernel->handle(Object(Symfony\Component\HttpFoundation\Request))
#38 {main}

Proposed resolution

Make the code in the pager service more defensive to query values outside the expected structure.

Remaining tasks

n/a

User interface changes

n/a

API changes

n/a

Data model changes

n/a

Release notes snippet

n/a

🐛 Bug report
Status

Needs work

Version

11.0 🔥

Component
Base 

Last updated 10 minutes ago

Created by

🇺🇦Ukraine BR0kEN Dnipro

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.69.0 2024