Add tests for SA-CORE-2024-006

In general we'd use expectException in a test, but in this case we want to do some more checks after the exception is thrown.. so we have a try / catch instead.

I am in two minds about having this very specific assertion about the TypeError:

$this->assertStringContainsString('Cannot assign Drupal\Component\PhpStorage\FileStorage to property Drupal\Core\Config\StorageComparer::$targetCacheStorage', $e->getMessage());

That feels a bit like it might break in future, and we wouldn't necessarily care so long as the TypeError is still thrown.

I'll leave it in for now.

Tests are passing on the MR.

mcdruid → credited benjifisher → .

mcdruid → credited greggles → .

mcdruid → credited jenlampton → .

mcdruid → credited larowlan → .

mcdruid → credited longwave → .

mcdruid → credited quicksketch → .

mcdruid → credited xjm → .

Adding credit from the private security issue.

Going on a limb

Not 100% the ticket the fix was in but trying to go off the security release note.

Applied a super small change to move it from config to file group.

I believe the rest is covering the security concern, if I'm wrong I apologize now

See comment on the MR.

I think this should be back at NR.

There is a linting error / warning in the MR but I don't understand what it's saying sufficiently to know whether it's related to this change - it doesn't appear to be at a glance.

I’d rebase and see

Yup appears the MR was just behind.

Great, thanks for the nudge in the right direction.

Committed 56f266d and pushed to 11.x. Thanks!

longwave → closed merge request !11258

Automatically closed - issue fixed for 2 weeks with no activity.