Wrong content can be returned for a path

This is a bit more challenging than I thought. So far, I came up with

    $global_config = $this->configFactory->get('system.site');
    $domain_config = $this->configFactory->get('domain.config.' . $domain_id . '.system.site');

    if ($domain_config) {
      $path = $domain_config->get('page.404');

      if (!empty($path)) {
        return $this->getAliasByPath($path, $langcode);
      }
    }

    if ($global_config) {
      $path = $global_config->get('page.404');

      if (!empty($path)) {
        return $this->getAliasByPath($path, $langcode);
      }
    }

    return $this->inner->getPathByAlias($alias, $langcode);

But this breaks valid, non-content paths (like /admin paths) and returns a 404. Attempts to load the route by path or alias seems to result in recursion errors.

I could be wrong but this seems like a big issue. The module appears to assign a domain_id record - but I think in order to adequately have this enforced and checked, you need to override the core AliasManager and AliasRepository to have their lookups respect the domain_id key. Otherwise it seems like you can enter any path for a Domain and if it matches a path assigned to another domain, Drupal will return that and route it to the user.

I am kind of stumped at how to get the desired behavior.

Rebuilding node permissions seems to fix this issue, but I am not sure how it got into that state to begin with.

s1933 → made their first commit to this issue’s fork.

Thanks for this report. I agree with you that it’s a critical issue.

Here is my first contribution. If no path alias entity is found in getPathByAlias(), load and return the 404 page if it exists.
To be sure that non-content aliases checked (like /admin), I added a function to determine whether the current alias exists on db.
I also updated the functional test to cover this use case.

Test failure appears to be in the base Domain module.

It is related to this current MR : https://git.drupalcode.org/project/domain/-/merge_requests/116/diffs?com...