path_alias can be passed unexpected data types for the path

Created on 27 February 2023, almost 2 years ago
Updated 3 March 2023, almost 2 years ago

Problem/Motivation

the Path_alias module is not compatible with PHP8.1 and need to be patched :
core/modules/path_alias/src/PathProcessor/AliasPathProcessor.php

L54 if (strpos($path, '//') === 0) {

As some modules have already done, replace the code by

L54 if (strpos((string) $path, '//') === 0) {
🐛 Bug report
Status

Postponed: needs info

Version

9.5

Component
Other 

Last updated about 5 hours ago

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @Nicoc
  • Status changed to Postponed: needs info almost 2 years ago
  • `$path` is documented as having to be a string. What are the steps to reproduce?

       * @param string $path
       *   The path to process, with a leading slash.
    
  • after i change the php version to 8.1 from 7.4, clear the cache, go to content page, and bim....

    Deprecated: strpos(): Passing null to parameter #1 ($haystack) of type string is deprecated in /var/www/html/web/core/modules/path_alias/src/PathProcessor/AliasPathProcessor.php on line 54

    PHP 8.1 change the game, if a function ask for a string, we have to pass a string, and null is not a string.

    The best way is to test the $path variable before use it.

    cd : https://php.watch/versions/8.1/internal-func-non-nullable-null-deprecation

  • Please explain the code path that is sending a null.

  • I think that's not the point!

    The goal is to secure the code, with PHP8.1, only the right type must be passed to a function, that the fact, whatever the way a null came to this function, it is necessary to manage, and anticipate this case, to guarantee to only pass a string type to a function that needs a string type in its declaration. :)

    Thank you.

  • Why not type hint in the function signature?

  • There may be a misunderstanding.

    In core/modules/path_alias/src/PathProcessor/AliasPathProcessor.php

    At L54, there is a strpos function, it is a PHP function. This function expects a string in its first parameter.

    With PHP8.1 we have to pass a string, and just a string, null is not a string, so you have to secure your code, test the $path variable to be sure it is a string, and nothing other.

    So, either test the $path variable before using the strpos function, or cast the $path variable, or do:

    strpos($path ?? '', '//')
    
Production build 0.71.5 2024