Project

General

Profile

Actions
Copy link

Bug #99023

closed

Regular expression is not escaped and causes errors

Added by Dmitry Dulepov about 2 years ago. Updated almost 2 years ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Backend API
Target version:
-
Start date:
2022-11-08
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
11
PHP Version:
7.4
Tags:
Complexity:
no-brainer
Is Regression:
Sprint Focus:

Description

In ExtensionManagementUtility:

                            switch ($positionIdentifier) {
                                case 'after':
                                case 'before':
                                    if (preg_match('/\\b' . $entityName . '\\b/', $palette['showitem']) > 0 || $entityName === 'palette:' . $paletteName) {

Function parameter $position is set to 'before:--div--;LLL:EXT:frontend/Resources/Private/Language/locallang_ttc.xlf:tabs.media'.
Variable $entityName becomes '--div--;LLL:EXT:frontend/Resources/Private/Language/locallang_ttc.xlf:tabs.media'

Called from https://github.com/georgringer/eventnews/blob/main/Configuration/TCA/Overrides/tx_news_domain_model_news.php#L102

Result is an exception:

[ TYPO3\CMS\Core\Error\Exception ]                                                                                                           
  Warning: preg_match(): Unknown modifier 'R' in /var/www/html/html/typo3/sysext/core/Classes/Utility/ExtensionManagementUtility.php line 277

Files

dbg.png (1.17 MB) dbg.png Dmitry Dulepov, 2022-11-08 15:36

Related issues 1 (0 open — 1 closed)

Related to TYPO3 Core - Bug #98960: Migration from switchable Controller Actions incompleteClosedBenni Mack2022-10-31

Actions
Actions
Copy link
 #1

Updated by Dmitry Dulepov about 2 years ago

There is the same unquoted regexp couple of lines below in that function.

Actions
Copy link
 #2

Updated by Dmitry Dulepov about 2 years ago 

diff --git a/Classes/Utility/ExtensionManagementUtility.php b/Classes/Utility/ExtensionManagementUtility.php
index 629978dce..522399ff4 100644
--- a/Classes/Utility/ExtensionManagementUtility.php
+++ b/Classes/Utility/ExtensionManagementUtility.php
@@ -274,7 +274,7 @@ class ExtensionManagementUtility
                             switch ($positionIdentifier) {
                                 case 'after':
                                 case 'before':
-                                    if (preg_match('/\\b' . $entityName . '\\b/', $palette['showitem']) > 0 || $entityName === 'palette:' . $paletteName) {
+                                    if (preg_match('/\\b' . preg_quote($entityName, '/') . '\\b/', $palette['showitem']) > 0 || $entityName === 'palette:' . $paletteName) {
                                         $newPosition = $positionIdentifier . ':--palette--;;' . $paletteName;
                                     }
                                     break;
@@ -284,7 +284,7 @@ class ExtensionManagementUtility
                                         $fieldExists = true;
                                         continue 2;
                                     }
-                                    if (preg_match('/\\b' . $entityName . '\\b/', $palette['showitem']) > 0) {
+                                    if (preg_match('/\\b' . preg_quote($entityName, '/') . '\\b/', $palette['showitem']) > 0) {
                                         self::addFieldsToPalette($table, $paletteName, $newFieldsString, $position);
                                         // Memorize that we already changed this palette, in case other types also use it
                                         $palettesChanged[$paletteName] = true;
Actions
Copy link
 #3

Updated by Anja Leichsenring about 2 years ago

  • Related to Bug #98960: Migration from switchable Controller Actions incomplete added
Actions
Copy link
 #4

Updated by Gerrit Code Review about 2 years ago

  • Status changed from New to Under Review

Patch set 1 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/76487

Actions
Copy link
 #5

Updated by Gerrit Code Review about 2 years ago

Patch set 2 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/76487

Actions
Copy link
 #6

Updated by Gerrit Code Review about 2 years ago

Patch set 3 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/76487

Actions
Copy link
 #7

Updated by Stephan Großberndt about 2 years ago

  • Description updated (diff)
Actions
Copy link
 #8

Updated by Gerrit Code Review about 2 years ago

Patch set 1 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/76488

Actions
Copy link
 #9

Updated by Gerrit Code Review about 2 years ago

Patch set 1 for branch 11.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/76495

Actions
Copy link
 #10

Updated by Oliver Bartsch about 2 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
Actions
Copy link
 #11

Updated by Benni Mack almost 2 years ago

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: Atom PDF