Project

General

Profile

Actions

Bug #102404

closed

Field scope in sys_csp_resolution is too small

Added by Peter Kraume 5 months ago. Updated 5 months ago.

Status:
Resolved
Priority:
Should have
Assignee:
Category:
Security
Target version:
-
Start date:
2023-11-19
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
12
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

In frontend context the field scope in table sys_csp_resolution is filled with a concatenation of "frontend." and the site configuration identifier.
When the site identifier is too long, new entries in sys_csp_resolution fail for frontend requests:

Uncaught TYPO3 Exception: #1406: An exception occurred while executing a query: Data too long for column 'scope' at row 1

This can happen e.g. in a fresh TYPO3 installation where there was no manual site configuration. Then the site identifiert looks like this:
autogenerated-1-c4ca4238a0b923820dcc509a6f75849b

The scope would then be frontend.autogenerated-1-c4ca4238a0b923820dcc509a6f75849b which is tool long.

To mitigate the problem we need to double the field size at least. This will solve the problem for the above mentioned case.

But since the site identifier has a TCA configuration for max. 255 chars I'd go for varchar(264).

Possible implication: the scope is used in the CSP backend module in a table view. A very long field value might break the design of the table.

Actions #1

Updated by Gerrit Code Review 5 months ago

  • Status changed from New to Under Review

Patch set 1 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/81794

Actions #2

Updated by Peter Kraume 5 months ago

  • Description updated (diff)
Actions #3

Updated by Gerrit Code Review 5 months ago

Patch set 1 for branch 12.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/81775

Actions #4

Updated by Peter Kraume 5 months ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
Actions

Also available in: Atom PDF