`OrderStorage::createWithSampleValues()` should create stub for payment_method

Created on 18 June 2024, 3 months ago
Updated 24 June 2024, 3 months ago

When calling `Order::createWithSampleValues()` during schema generation using the new Generate JSON schema for content entity types Needs review functionality, all payment methods are returned. This is because, AFAICT, payment methods do not implement query-level access control. The order storage should special-case payment_method to a new, stub payment method if one is not passed in the values array.

I considered whether this is a security issue but came down on probably not, as there are few client-facing code paths making use of ::createWithSampleValues(). In addition, even if you did have a masked card number exposed where it shouldn't be, it's not usable and would require a separate exploit to use in payment. That said, I think this is at least a bug.

🐛 Bug report
Status

Needs work

Version

2.0

Component

Order

Created by

🇺🇸United States bradjones1 Digital Nomad Life

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @bradjones1
  • Merge request !272Add mock of payment method for sample order → (Open) created by bradjones1
  • Open on Drupal.org →
    Core: 9.5.x + Environment: PHP 8.0 & MySQL 5.7
    6:16
    6:16
    Queueing
  • Status changed to Needs review 3 months ago
  • 🇺🇸United States bradjones1 Digital Nomad Life
  • Pipeline finished with Success
    3 months ago
    Total: 539s
    #201596
  • 🇺🇸United States bradjones1 Digital Nomad Life

    Adding similar issues from Commerce

  • 🇮🇱Israel jsacksick

    This change doesn't look right... There is no payment_method field if there is no payment module enabled? The payment_method field is added as a base field by the commerce_payment module.

  • Status changed to Needs work 3 months ago
  • 🇺🇸United States bradjones1 Digital Nomad Life

    Ah good catch, I need to add a conditional in there. This was just my quick-and-dirty from my local project.

  • 🇮🇱Israel jsacksick

    Or perhaps the right fix is to just set a query_access handler?

  • 🇺🇸United States bradjones1 Digital Nomad Life

    Re: #7, @jsacksick and I chatted a bit via DM. That would also be a potential way to address this, though I am curious about the very Commerce-y angle of the fact that many payment methods are "owned" by the anonymous user, and so filtering by the current user (who could likely be anonymous?) would need to be addressed. I suppose we could further special-case that, but that would perhaps create a hard-to-debug condition for people legitimately trying to do the thing we are special-casing.

  • 🇬🇧United Kingdom alexpott 🇪🇺🌍

    I might be wrong but isn't this a bug in \Drupal\Core\Field\Plugin\Field\FieldType\EntityReferenceItem::generateSampleValue() shouldn't that respect the target_bundles set in the field too? Or have I misunderstood the bug?

  • 🇬🇧United Kingdom alexpott 🇪🇺🌍

    @jsacksick explained that I am wrong. What we need to do here is alway generate a new payment method. I think making this change here is fine. Maybe add a todo to try to do this with access control but I think that that is going to be hard.

  • 🇬🇧United Kingdom alexpott 🇪🇺🌍

    I also think a comment explaining why this is being done would be great.

  • 🇮🇱Israel jsacksick

    One thing I was wondering, should we dispatch an event so we can set the payment_method from an event subscriber that lives in commerce_payment? Also createWithSampleValues() isn't static (at least the parent method isn't). If we don't go with the event, I guess we should go with a moduleExists() check (ofc less elegant).

  • 🇺🇸United States bradjones1 Digital Nomad Life

    Working on this further, I believe commerce_payment has the same issue as it also references a payment method. One wrinkle there, however, is that it doesn't appear there's any code path to restrict the payment method type that can be placed on a payment? Do we need a way for payment types to convey what types of payment methods may be used, so we can accurately create a sample value?

  • Open in Jenkins → Open on Drupal.org →
    Core: 9.5.x + Environment: PHP 8.0 & MySQL 5.7
    last update 3 months ago
    795 pass
  • Pipeline finished with Failed
    3 months ago
    Total: 581s
    #206490
  • 🇺🇸United States bradjones1 Digital Nomad Life

    Answering my own question, methods and payment types are restricted by the gateway in use. So creating a sample value should draw on that context, if available. Rubber-ducking: https://drupal.slack.com/archives/C1TLCCF9B/p1719209765390819

  • Open in Jenkins → Open on Drupal.org →
    Core: 9.5.x + Environment: PHP 8.0 & MySQL 5.7
    last update 3 months ago
    795 pass
  • 🇺🇸United States bradjones1 Digital Nomad Life

    OK, I updated this to handle a similar issue with sample payment entity creation. Ended up adding a mapper to the payment gateway plugin manager to find a gateway that supports a given payment type/payment method type pair. Which is a nice little DX improvement.

  • Pipeline finished with Failed
    3 months ago
    Total: 658s
    #206542
  • Open in Jenkins → Open on Drupal.org →
    Core: 9.5.x + Environment: PHP 8.0 & MySQL 5.7
    last update 3 months ago
    788 pass, 2 fail
  • Open in Jenkins → Open on Drupal.org →
    Core: 9.5.x + Environment: PHP 8.0 & MySQL 5.7
    last update 3 months ago
    795 pass
  • Pipeline finished with Canceled
    3 months ago
    Total: 335s
    #207402
  • Pipeline finished with Failed
    3 months ago
    Total: 501s
    #207409
  • Pipeline finished with Failed
    23 days ago
    Total: 409s
    #274738
  • Pipeline finished with Success
    23 days ago
    Total: 380s
    #274750
Production build 0.71.5 2024