(This was reported by @berdir to the security team as a private issue. Since access to the autocomplete callback requires a restricted permission, the issue can be handled in public.)
$pattern = '/^' . $request->query->get('q') . '/i'; $prefixMatches = preg_grep($pattern, $categories);This is in \Drupal\monitoring\Controller\CategoryAutocompleteController::autocomplete, the route is restricted to the administer monitoring permission which _is_ a restricted permission.
Write a patch, review, commit.
Active
1.0
Code
It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the “Report a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.
Issue #3482105 by mr.baileys: Unescaped regular expression input in...
Automatically closed - issue fixed for 2 weeks with no activity.