This was originally reported to the security team but it was decided it could be handled in a public issue.
Steps to Reproduce:
1. On a Fresh Drupal Install of 10.x Enable the RESTful Web Services Module
and Views module2. Create a new Views Rest Export without any Contextual filters
a. In my test, my rest export was configured to only return the fields of
article content, no filters were applied.
b. Path to my rest export is called: '/rest_export'3. Access your rest export without specifying the _format parameter and add
additional path segment(s) when none are expected.
a. For example: If the path to your rest_export is '/rest_export', the
intended way to access your resource would be:
'http://mysite.com/rest_export?_format=json' however if someone attempts to
access, http://mysite.com/rest_export/test the issue will occur.If this route is accessed in this way the Drupal logs are filled up with
Client Errors throwing
Symfony\Component\HttpKernel\Exception\NotAcceptableHttpException until a PHP
timeout is reached or memory is exhausted.Expected behavior: Throw a 404 or Client Error and stop processing.
Active
11.0 🔥
base system
I think this is the same problem as 🐛 DefaultExceptionHtmlSubscriber should not clone the request for 401s Active except for 406s instead of 400s this time. IMO we need an allowlist of status codes that we'll try to render a Drupal page for (and it should probably be limited to only 403s and 404s).