Access bypass - ApiLayoutController::componentInstanceExistInComponentData doesn't correctly recurse the tree
>>> [!note] Migrated issue
<!-- Drupal.org comment -->
<!-- Migrated from issue #3539909. -->
Reported by: [larowlan](https://www.drupal.org/user/395439)
>>>
<h3 id="overview">Overview</h3>
<p><a href="https://git.drupalcode.org/project/experience_builder/-/blob/1.x/src/Controller/ApiLayoutController.php#L497">ApiLayoutController::componentInstanceExistInComponentData</a> doesn't correctly traverse the tree, the check for empty slot data on line 504 prevents checking the current components in scope.</p>
<p>This actually allows access bypass because <a href="https://git.drupalcode.org/project/experience_builder/-/blob/1.x/src/Controller/ApiLayoutController.php#L268">the check in <code>ApiLayoutContoller::patch</code></a> that you can edit the region isn't performed if the region isn't found.</p>
<h3>Steps to reproduce</h3>
<p>Load the data from layout-default.json<br>
Call this method with the UUID <code>eaa37ee1-7d50-4041-b04c-c80bdbac3412</code> - you should get <code>content</code> but instead get <code>NULL</code></p>
<h3 id="proposed-resolution">Proposed resolution</h3>
<p>Fix</p>
<h3 id="ui-changes">User interface changes</h3>
issue