Access bypass - ApiLayoutController::componentInstanceExistInComponentData doesn't correctly recurse the tree
>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3539909. --> Reported by: [larowlan](https://www.drupal.org/user/395439) >>> <h3 id="overview">Overview</h3> <p><a href="https://git.drupalcode.org/project/experience_builder/-/blob/1.x/src/Controller/ApiLayoutController.php#L497">ApiLayoutController::componentInstanceExistInComponentData</a> doesn't correctly traverse the tree, the check for empty slot data on line 504 prevents checking the current components in scope.</p> <p>This actually allows access bypass because <a href="https://git.drupalcode.org/project/experience_builder/-/blob/1.x/src/Controller/ApiLayoutController.php#L268">the check in <code>ApiLayoutContoller::patch</code></a> that you can edit the region isn't performed if the region isn't found.</p> <h3>Steps to reproduce</h3> <p>Load the data from layout-default.json<br> Call this method with the UUID <code>eaa37ee1-7d50-4041-b04c-c80bdbac3412</code> - you should get <code>content</code> but instead get <code>NULL</code></p> <h3 id="proposed-resolution">Proposed resolution</h3> <p>Fix</p> <h3 id="ui-changes">User interface changes</h3>
issue