Project

General

Profile

Actions

Bug #101525

closed

foreach() argument must be of type array|object, null given in MvcPropertyMappingConfigurationService.php

Added by Ralph Brugger over 1 year ago. Updated over 1 year ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Frontend
Target version:
-
Start date:
2023-08-02
Due date:
% Done:

0%

Estimated time:
TYPO3 Version:
11
PHP Version:
8.1
Tags:
Complexity:
easy
Is Regression:
Sprint Focus:
On Location Sprint

Description

In our log files we see those erros a few times a day:

(1/1) #1476107295 TYPO3\CMS\Core\Error\Exception
PHP Warning: foreach() argument must be of type array|object, null given in 
typo3_src/typo3_src-11.5.30/typo3/sysext/extbase/Classes/Mvc/Controller/MvcPropertyMappingConfigurationService.php 
line 147

This is an extbase / fluid list view.

Here is a sample request.

?tx_rsmpress_list[__referrer][%40extension]=Rsmpress
&tx_rsmpress_list[__referrer][%40vendor]=RSM
&tx_rsmpress_list[__referrer][%40controller]=Message
&tx_rsmpress_list[__referrer][%40action]=list
&tx_rsmpress_list[__referrer][arguments]=YTowOnt9e040d2f4e53a183bc4dd114962f85091fb657230
&tx_rsmpress_list[__referrer][%40request]=a%3A4%3A{s%3A10%3A"%40extension"%3Bs%3A8%3A"Rsmpress"%3Bs%3A11%3A"%40controller"%3Bs%3A7%3A"Message"%3Bs%3A7%3A"%40action"%3Bs%3A4%3A"list"%3Bs%3A7%3A"%40vendor"%3Bs%3A3%3A"RSM"%3B}b25d2b7377de66bbe9b91df012987004255d09cd
&tx_rsmpress_list[__trustedProperties]=a%3A0%3A{}f7ef143576e2a243c81263679b9422dd99b931d0
&tx_rsmpress_list[search][keywords]=impfung
&tx_rsmpress_list[search][from]=
&tx_rsmpress_list[search][to]=
&tx_rsmpress_list[search][ministry]=0

PCP-Code:
MvcPropertyMappingConfigurationService.php : Line 145

$trustedProperties = json_decode($serializedTrustedProperties, true);
foreach ($trustedProperties as $propertyName => $propertyConfiguration) {
    if (!$controllerArguments->hasArgument($propertyName)) {
        continue;
        }
    $propertyMappingConfiguration = $controllerArguments->getArgument($propertyName)->getPropertyMappingConfiguration();
    $this->modifyPropertyMappingConfiguration($propertyConfiguration, $propertyMappingConfiguration);
}

In this case $trustedProperties is null

Maybe this should be checked before?

$trustedProperties = json_decode($serializedTrustedProperties, true);
if ($trustedProperties && is_array($trustedProperties)){
  foreach ($trustedProperties as $propertyName => $propertyConfiguration) {
      if (!$controllerArguments->hasArgument($propertyName)) {
          continue;
          }
      $propertyMappingConfiguration = $controllerArguments->getArgument($propertyName)->getPropertyMappingConfiguration();
      $this->modifyPropertyMappingConfiguration($propertyConfiguration, $propertyMappingConfiguration);
  }
}

Related issues 1 (0 open1 closed)

Is duplicate of TYPO3 Core - Bug #97337: Empty $trustedProperties cause a PHP warningClosedThomas Hohn2022-04-08

Actions
Actions #1

Updated by Christian Kuhn over 1 year ago

  • Sprint Focus set to On Location Sprint
Actions #2

Updated by Max Frerichs over 1 year ago

I've taken a look at it and although I was not able to reproduce it but the string in __trustedProperties looks like it's serialized, but trustedProperties are actually JSON-encoded. Even if you remove everything from within a f:form ViewHelper, that could contain a property attribute, this should not happen.

The only two ways this could happen, that came into my mind:
1. Some bad guys saved an older version of the website (before switch from serialize to json_encode/json_decode for Extbase arguments) and tried to send this form (e.g. spammers).
2. Some custom property-mapping configuration that I don't understand, has been done.

Nevertheless, it's a good idea imo to catch this case. I think, checking for an array before foreach() should be sufficient.

Actions #3

Updated by Oliver Klee over 1 year ago

There already is a change that solves a similar problem - maybe we can use/continue that?

https://review.typo3.org/c/Packages/TYPO3.CMS/+/78002

Actions #4

Updated by Gerrit Code Review over 1 year ago

  • Status changed from New to Under Review

Patch set 1 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/80322

Actions #5

Updated by Max Frerichs over 1 year ago

Oliver Klee wrote in #note-3:

There already is a change that solves a similar problem - maybe we can use/continue that?

https://review.typo3.org/c/Packages/TYPO3.CMS/+/78002

Yes, we should use that. I agree with you and Benjamin, that throwing an exception is the cleanest solution.

Actions #6

Updated by Christian Kuhn over 1 year ago

  • Is duplicate of Bug #97337: Empty $trustedProperties cause a PHP warning added
Actions #7

Updated by Christian Kuhn over 1 year ago

  • Status changed from Under Review to Closed

See duplicate.

Actions

Also available in: Atom PDF