TYPO3 Core

We discovered a cache inconsistency where processed images can be removed from the filesystem, even though they are still part of a cached page. We have tested this with TYPO3 9 LTS, but it is very likely also an issue with TYPO3 10 LTS.

Steps to reproduce the issue

1. Create two pages pageA and pageB
2. Add an images content element to pageA and pageB and choose the same image demo_image.png
3. Apply image processing to the image (e.g. max width 50px) on both pages
4. Open both pages in the frontend and note the generated unique hash (e.g. /fileadmin/_processed_/d/2/csm_demo_2cb965e686.png -> 2cb965e686). The hash should be the same on both pages.
5. Change the column modification_date in sys_file for demo_image.png, this will lead to a new hash for the processed image
6. Clear the page cache for pageA only
7. Open pageA in the frontend, note the new unique hash e.g. /fileadmin/_processed_/d/2/csm_demo_bf52a6057a.png -> bf52a6057a)
8. Note that the previous processed image csm_demo_2cb965e686.png has been removed from the file system
9. Open pageB (make sure caching is not disabled, e.g. use inkognito mode) and note that the image is missing on the page because it is still referencing csm_demo_2cb965e686.png, which has been deleted.

Proposed fix

Add page cache tags for all processed images. Whenever a processed image is removed, clear the page cache of all pages including that image using the cache tags.

Additional info

At the moment the deletion is done in TYPO3\CMS\Core\Resource\ProcessedFile in a function called needsReprocessing. Probably processed images should not be deleted in a seemingly innocent method called needsReprocessing. See https://github.com/TYPO3/TYPO3.CMS/blob/9bb994f492e75efcfe139c3d6a64ef42dbef9bd1/typo3/sysext/core/Classes/Resource/ProcessedFile.php#L513-L515