>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3611004. --> Reported by: [chris burge](https://www.drupal.org/user/1826152) Related to !5 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p> The module allows administrators to configure a custom path for the test<br> endpoint via the settings form. The path is stored in config and used at<br> runtime by <code>RouteGenerator</code> to dynamically register a route: </p> <pre><pre>// src/Routing/RouteGenerator.php<br>$collection-&gt;add("http_status_code_test.test_endpoint", new Route(<br>&nbsp; $config-&gt;get('endpoint_path'),<br>&nbsp; ...<br>));</pre></pre><p> The only validation applied to <code>endpoint_path</code> is a config schema<br> regex constraint that requires the value to begin with a <code>/</code>. There<br> is no check that the path is free of conflicts with routes already registered<br> by Drupal core or other modules. </p> <p> Drupal's routing system has no built-in conflict detection. When two routes<br> share the same path, the winner is determined by <strong>fit score</strong><br> (the number of static path segments) with alphabetical route name as the<br> tiebreaker. Because <code>http_status_code_test.test_endpoint</code> sorts<br> before many core route names (e.g. <code>user.login</code>,<br> <code>user.page</code>), this module's dynamically registered route would win<br> any fit tie, making the original route permanently unreachable until the<br> module is reconfigured or disabled. </p> <p> For example, setting <code>endpoint_path</code> to <code>/user/login</code><br> would replace the Drupal login page with this module's open test endpoint for<br> the lifetime of the configuration. The same applies to any other static path<br> in the system, including <code>/admin</code>, <code>/user/logout</code>, and<br> paths registered by contrib modules. </p> <h4 id="summary-steps-reproduce">Steps to reproduce</h4> <ol> <li>Install the module and navigate to <em>Admin &rarr; Configuration &rarr; Development &rarr; HTTP Status Code Test</em>.</li> <li>Set <strong>Endpoint Path</strong> to <code>/user/login</code> and save.</li> <li>Clear caches or allow the route rebuild to complete.</li> <li>Visit <code>/user/login</code>.</li> <li>Observe that the login form is no longer served; instead the test endpoint<br> response is returned.</li> </ol> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p> Add a <code>validateForm()</code> method to<br> <code>src/Form/ConfigForm.php</code> that queries the route provider for any<br> existing routes matching the submitted path. If any routes are found &mdash; after<br> excluding this module's own route, to allow re-saving an unchanged value &mdash; a<br> form error is set and the configuration is not saved. </p> <p>The implementation injects <code>router.route_provider</code> as a new<br> constructor dependency and uses its <code>getRoutesByPattern()</code> method:</p> <pre><pre>public function validateForm(array &amp;amp;$form, FormStateInterface $form_state) {<br>&nbsp; $path = $form_state-&gt;getValue('endpoint_path');<br><br>&nbsp; $routes = $this-&gt;routeProvider-&gt;getRoutesByPattern($path);<br>&nbsp; $routes-&gt;remove('http_status_code_test.test_endpoint');<br><br>&nbsp; if (count($routes) &gt; 0) {<br>&nbsp;&nbsp;&nbsp; $form_state-&gt;setErrorByName(<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 'endpoint_path',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $this-&gt;t('The path %path conflicts with an existing route and cannot be used.', ['%path' =&gt; $path])<br>&nbsp;&nbsp;&nbsp; );<br>&nbsp; }<br><br>&nbsp; parent::validateForm($form, $form_state);<br>}</pre></pre><p> This approach catches conflicts at the point of user input and provides a<br> clear error message. It does not prevent conflicts introduced via config<br> import (which bypasses form validation), but it covers the primary attack<br> surface for a privileged user misconfiguring the module through the UI. </p> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <ul> <li>Update form class</li> <li>Update test coverage</li> </ul> <h3 id="summary-ui-changes">User interface changes</h3> <p>None</p> <h3 id="summary-api-changes">API changes</h3> <p>None</p> <h3 id="summary-data-model-changes">Data model changes</h3> <p>None</p>