TYPO3 Core

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63272

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63272

Patch set 2 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/64274

Patch set 3 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/64274

Patch set 4 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/64274

I am sorry to get to this issue once again... it seems like the Problem is solved but not for me. Now my Typo3-Logs are flooded with the bad requests-Exception instead... so nothing is won. I am running several Typo3 9.5.20 Sites on a Mittwald-Server and some of them throwing this Exception 200 times a day - wich is a littel bit annoying as you can imagine.
For Example:

Core: Exception handler (WEB): Uncaught TYPO3 Exception: #1581862822: The HMAC of the form could not be validated. | TYPO3\CMS\Core\Error\Http\BadRequestException thrown in file /html/typo3/typo3_src-9.5.20/typo3/sysext/extbase/Classes/Mvc/Controller/MvcPropertyMappingConfigurationService.php in line 136. Requested URL: https://www.esther-muench.de/startseite?tx_powermail_pi1%%5Baction%%5D=confirmation&tx_powermail_pi1%%5Bcontroller%%5D=Form&cHash=d6af9e27348305de23590d3dc3af1c30

So I am looking for Help since a few years now (I am not competent enough to solve it by my self I must admit)...

This issue is NOT resolved. Now we have a different exception - BadRequestException - but it still floods the TYPO3 log. There is no option to prevent this.

I am wondering, why the following try-catch emits its own message - instead of just reusing the original messages of the exceptions it catches?

https://github.com/TYPO3/TYPO3.CMS/commit/f553d918cb69eb9dc525cad689ce44c08e9b5f43#diff-2f30e714393f41c4befdde4343f5e7a7R136

 try {
            $serializedTrustedProperties = $this->hashService->validateAndStripHmac($trustedPropertiesToken);
        } catch (InvalidHashException | InvalidArgumentForHashGenerationException $e) {
            throw new BadRequestException('The HMAC of the form could not be validated.', 1581862822);
        }

This would help debugging on production systems a lot. Bugfix?

I can confirm this for 9.5.22. We have about 10-40 of those entries per day! Not only the logs get flooded, it's also hard to spot real error-logs that are lurking inbetween. A solution would be appreciated. ;) Example:

Core: Exception handler (WEB): Uncaught TYPO3 Exception: #1581862822: The HMAC of the form could not be validated. | TYPO3\CMS\Core\Error\Http\BadRequestException thrown in file /var/www/typo3/public/typo3/sysext/extbase/Classes/Mvc/Controller/MvcPropertyMappingConfigurationService.php in line 136. Requested URL: https://www.exampledomain.com/unternehmen/kontakt?tx_powermail_pi1%%5Baction%%5D=create&tx_powermail_pi1%%5Bcontroller%%5D=Form&cHash=3e78aed6aa31a247482c8cbe29b17a11

Would like to echo the above comments - if this error is triggered by TYPO3 evaluating the user as "spam", I don't see why it needs to fill the `typo3_XXX` log up, especially with such verbose information and an `alert` status.

Apologies if I have misunderstood, but my impression is that nothing can be done with this error as a site maintainer? If that is the case it would be good to at least have the option of disabling this error.

I get the following with 9.5.24:

Mon, 08 Feb 2021 11:12:20 +0000 [ALERT] request="b21030be741ad" component="TYPO3.CMS.Frontend.ContentObject.Exception.ProductionExceptionHandler": Oops, an error occurred! Code: 202102081112203a990003 - {"exception":"TYPO3\\CMS\\Core\\Error\\Http\\BadRequestException: The HMAC of the form could not be validated. in /usr/local/share/typo3/9.5/typo3/sysext/extbase/Classes/Mvc/Controller/MvcPropertyMappingConfigurationService.php:136
Stack trace:
#0 /usr/local/share/typo3/9.5/typo3/sysext/extbase/Classes/Mvc/Controller/ActionController.php(155): TYPO3\\CMS\\Extbase\\Mvc\\Controller\\MvcPropertyMappingConfigurationService->initializePropertyMappingConfigurationFromRequest(Object(TYPO3\\CMS\\Extbase\\Mvc\\Web\\Request), Object(TYPO3\\CMS\\Extbase\\Mvc\\Controller\\Arguments))
#1 /usr/local/share/typo3/9.5/typo3/sysext/extbase/Classes/Mvc/Dispatcher.php(73): TYPO3\\CMS\\Extbase\\Mvc\\Controller\\ActionController->processRequest(Object(TYPO3\\CMS\\Extbase\\Mvc\\Web\\Request), Object(TYPO3\\CMS\\Extbase\\Mvc\\Web\\Response))
#2 /usr/local/share/typo3/9.5/typo3/sysext/extbase/Classes/Mvc/Web/FrontendRequestHandler.php(92): TYPO3\\CMS\\Extbase\\Mvc\\Dispatcher->dispatch(Object(TYPO3\\CMS\\Extbase\\Mvc\\Web\\Request), Object(TYPO3\\CMS\\Extbase\\Mvc\\Web\\Response))
#3 /usr/local/share/typo3/9.5/typo3/sysext/extbase/Classes/Core/Bootstrap.php(172): TYPO3\\CMS\\Extbase\\Mvc\\Web\\FrontendRequestHandler->handleRequest()
#4 /usr/local/share/typo3/9.5/typo3/sysext/extbase/Classes/Core/Bootstrap.php(159): TYPO3\\CMS\\Extbase\\Core\\Bootstrap->handleRequest()
#5 [internal function]: TYPO3\\CMS\\Extbase\\Core\\Bootstrap->run('', Array)
....

Apologies if I have misunderstood, but my impression is that nothing can be done with this error as a site maintainer? If that is the case it would be good to at least have the option of disabling this error.

THANK YOU! I am dealing with this for several years now... nothing happens. VERRY disappointing. Up to 100 "Errors" a day...
Is there ANYTHING going on to solve that S&#=&t?

There is an open patch ready for test and review: https://review.typo3.org/c/Packages/TYPO3.CMS/+/68196

Patch has been merged to master and v10, so I think this issue can be closed

I'm still have the same issue in the production context, Typo3 v11.

component="TYPO3.CMS.Frontend.ContentObject.Exception.ProductionExceptionHandler": Oops, an error occurred! Code: 20220616140959da0cf9eb- BadRequestException: The HMAC of the form could not be validated., in file /html/typo3/web/typo3/sysext/extbase/Classes/Mvc/Controller/MvcPropertyMappingConfigurationService.php:142 - {"exception":"TYPO3\\CMS\\Core\\Error\\Http\\BadRequestException: The HMAC of the form could not be validated.