oEmbed field formatter creates wrong hash when leaving empty dimensions

Created on 22 August 2023, 10 months ago
Updated 15 March 2024, 3 months ago

Problem/Motivation

After update core from 10.0.x to 10.1.x, this issue happens.

In the remote video media type, Video URL is rendered with format.
User can set the maximum width and height, in the field format settings. Although the field is using input element of number type, the value can be empty rather than 0.

When it is empty, it causes unmatched hash when checking the equality in OEmbedIframeController.php LINE: 147
And the frontend error occurs with the message "A client error happened"

Steps to reproduce

  1. Enable media module
  2. Go to media type "Remote video"
  3. Go to "Manage display" of the Remote video
  4. Edit field "Video URL" and use format "oEmbed content"
  5. Edit the format settings and remove the number from either "Maximum Width or Height" and save the field setting and entire display
  6. Create a "Remote video" media asset and view it at /media/{id}
    Standalone media URL (admin/config/media/media-settings) is required for the testing purpose

Proposed resolution

OEmbedIframeController.php compares the original hash with one created with max_width and max_height in integer.

    $url = $request->query->get('url');
    $max_width = $request->query->getInt('max_width');
    $max_height = $request->query->getInt('max_height');
    
    // Hash the URL and max dimensions, and ensure it is equal to the hash
    // parameter passed in the query string.
    $hash = $this->iFrameUrlHelper->getHash($url, $max_width, $max_height);
    if (!hash_equals($hash, $request->query->get('hash', ''))) {
      throw new BadRequestHttpException('This resource is not available');
    }

However if the field setting has empty value, NULL will be used to create the original hash.

In the viewElements() function in the OEmbedFormatter.php, make sure the $max_width, $max_height always return integer.

Remaining tasks

Use existing test
Review

User interface changes

Not sure if it make sense to make the the fields of dimensions in the formatter setting mandatory.

API changes

Data model changes

Release notes snippet

🐛 Bug report
Status

Needs work

Version

11.0 🔥

Component
Media 

Last updated 18 minutes ago

Created by

🇹🇼Taiwan amourow

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.69.0 2024