Deprecation in Html::cleanCssIdentifier()

Created on 23 April 2024, 2 months ago
Updated 30 April 2024, about 2 months ago

Problem/Motivation

Fuzzing reveals that Html::cleanCssIdentifier() triggers a deprecation when called with a malformed string:

   DEPRECATED  preg_replace(): Passing null to parameter #3 ($subject) of type array|string is deprecated in core/lib/Drupal/Component/Utility/Html.php on line 129.

Steps to reproduce

This can be reproduced with the attached file:

\Drupal\Component\Utility\Html::cleanCssIdentifier(file_get_contents('/var/www/crash-990e7227d1b261b58910c41def8090bb.txt'))

Proposed resolution

The code should probably check if $identifier is NULL before calling preg_replace.

๐Ÿ› Bug report
Status

Needs work

Version

11.0 ๐Ÿ”ฅ

Component
Baseย  โ†’

Last updated about 3 hours ago

Created by

๐Ÿ‡ซ๐Ÿ‡ทFrance prudloff Lille

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.69.0 2024