Verified Commit 3642b22e authored by Jess's avatar Jess
Browse files

SA-CORE-2025-005 by zhero, nils.destoop, dragos-dumi, svendecabooter,... 

SA-CORE-2025-005 by zhero, nils.destoop, dragos-dumi,  svendecabooter, mcdruid, alexpott, catch, larowlan, cilefen, nils.destoop, longwave, xjm, poker10, jenlampton, ram4nd

(cherry picked from commit b1b2cdf4)
parent 70e5d0d7

core/lib/Drupal/Core/Security/RequestSanitizer.php

+4 −0
Original line number Diff line number Diff line
@@ -5,6 +5,7 @@ 
use Drupal\Component\Utility\UrlHelper;

use Symfony\Component\HttpFoundation\ParameterBag;

use Symfony\Component\HttpFoundation\Request;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;



/**

 * Sanitizes user input.
@@ -40,6 +41,9 @@ class RequestSanitizer { 
   *   The sanitized request.

   */

  public static function sanitize(Request $request, array $safe_keys, $log_sanitized_keys = FALSE) {

    if ($request->getMethod() !== $request->getRealMethod() && $request->isMethodSafe()) {

      throw new BadRequestHttpException("Changing a request's method to a safe method is not supported.");

    }

    if (!$request->attributes->get(self::SANITIZED, FALSE)) {

      $update_globals = FALSE;

      $bags = [