- Issue created by @prudloff
- 🇫🇷France prudloff Lille
I added and updated the patch from the private issue.
People from the "Fixed by" section of https://www.drupal.org/sa-core-2024-002 → should probably be credited.
This is a followup to SA-CORE-2024-002 which affected CKEditor5ImageController.
We should have a test that prevents this vulnerability from being reintroduced.
We should add a unit test that replicates the upload conditions that triggered the vulnerability.
Active
11.0 🔥
ckeditor5.module
The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.
It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.
I added and updated the patch from the private issue.
People from the "Fixed by" section of
https://www.drupal.org/sa-core-2024-002 →
should probably be credited.