- Issue created by @BramDriesen
This was originally logged as a private issue to the security team, but was cleared to be moved to the public queue
Content with no text format (NULL) can have its text format silently set to something else when the default format is changed and the content is re-saved by an admin.
To really fix the root cause of this bug - make sure there is no scenario where formatted text can be stored with a NULL text format (because that actually doesn't make any sense). This would mean addressing the bug in the field UI that allows it to happen in the first place, doing something to fix historical cases in the database, etc.
With that, we could safely go ahead with patch #7 as the actual security fix (as a secure fallback for any cases we missed).
Re-roll as a merge request.
Update the field UI as in the proposed solution.
N/A
N/A
N/A
N/A
To be provided.
List of people who worked on the private issue:
Needs work
7.0 ⚰️
field system
It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the “Report a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.
It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.