Add test for SA-CORE-2024-002

Created on 30 May 2025, 29 days ago

Problem/Motivation

This is a followup to SA-CORE-2024-002 which affected CKEditor5ImageController.
We should have a test that prevents this vulnerability from being reintroduced.

Steps to reproduce

Proposed resolution

We should add a unit test that replicates the upload conditions that triggered the vulnerability.

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

πŸ“Œ Task
Status

Active

Version

11.0 πŸ”₯

Component

ckeditor5.module

Created by

πŸ‡«πŸ‡·France prudloff Lille

Live updates comments and jobs are added and updated live.
  • Needs tests

    The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.

  • Security improvements

    It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.

Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024