Bug #104509
Updated by Jannis Bell 4 months ago
[[https://github.com/TYPO3/typo3/blob/main/typo3/sysext/core/Classes/Package/AbstractServiceProvider.php#L167]]
<pre><code class="php">
public static function configureIcons(ContainerInterface $container, \ArrayObject $icons, ?string $path = null): \ArrayObject
{
$path = $path ?? static::getPackagePath();
$iconsFileNameForPackage = $path . 'Configuration/Icons.php';
if (file_exists($iconsFileNameForPackage)) {
$definedIconsInPackage = require $iconsFileNameForPackage;//<-- Here the Icons.php is called
//Code from Icons.php is executed
//$icons = somethingThatsNotAnArrayObject
if (is_array($definedIconsInPackage)) {
//Now $icons is probably not an ArrayObject anymore, and $icons->exchangeArray() is called
$icons->exchangeArray(array_merge($icons->getArrayCopy(), $definedIconsInPackage));
// e.g. array()->exchangeArray() will lead to an error
}
}
return $icons;
}
</code></pre>
This code from the AbstractServiceProvider, with my comments should display how the bug comes to life.
It is in the Code since 11.5 as far as I have seen.
Can you please wrap the inclusion of the Icons.php in a new function?
<pre><code class="php">
public static function requirePHPFile(string $filepath): mixed
{
//this protects the local variables from being changed accidentally by another user/developer
return require $filepath;
}
</code></pre>
I just found this version being used:
[[https://github.com/TYPO3/typo3/blob/13.1/typo3/sysext/core/Classes/Configuration/Tca/TcaFactory.php#L109]]
<pre><code class="php">
// To require TCA in a safe scoped environment avoiding local variable clashes.
// Note: Return type 'mixed' is intended, otherwise broken TCA files with missing "return [];" statement would
// emit a "return value must be of type array, int returned" PHP TypeError. This is mitigated by an array
// check below.
$scopedReturnRequire = static function (string $filename): mixed {
return require $filename;
};
</code></pre>