Skip to content

Commit 11759de

Browse files
pawan-adobe-securitypawan-adobe-security
authored
Merge branch '2.4.7-beta2-develop' into 2.4-develop-2.4.7-beta2-develop-sync-08252023
2 parents ed69801 + 2117252 commit 11759de

File tree

19 files changed

+212
-85
lines changed

19 files changed

+212
-85
lines changed

‎app/code/Magento/Customer/Plugin/Webapi/Controller/Rest/ValidateCustomerData.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ class ValidateCustomerData
2828
*/
2929
public function beforeOverride(ParamsOverrider $subject, array $inputData, array $parameters): array
3030
{
31-
if (isset($inputData[self:: CUSTOMER_KEY])) {
32-
$inputData[self:: CUSTOMER_KEY] = $this->validateInputData($inputData[self:: CUSTOMER_KEY]);
31+
if (isset($inputData[self::CUSTOMER_KEY])) {
32+
$inputData[self::CUSTOMER_KEY] = $this->validateInputData($inputData[self::CUSTOMER_KEY]);
3333
}
3434
return [$inputData, $parameters];
3535
}
@@ -45,7 +45,7 @@ private function validateInputData(array $inputData): array
4545
$result = [];
4646

4747
$data = array_filter($inputData, function ($k) use (&$result) {
48-
$key = is_string($k) ? strtolower($k) : $k;
48+
$key = is_string($k) ? strtolower(str_replace('_', "", $k)) : $k;
4949
return !isset($result[$key]) && ($result[$key] = true);
5050
}, ARRAY_FILTER_USE_KEY);
5151

‎app/code/Magento/Customer/Test/Unit/Plugin/Webapi/Controller/Rest/ValidateCustomerDataTest.php

Lines changed: 21 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88
namespace Magento\Customer\Test\Unit\Plugin\Webapi\Controller\Rest;
99

1010
use Exception;
11-
use Magento\Framework\App\ObjectManager;
1211
use Magento\Customer\Plugin\Webapi\Controller\Rest\ValidateCustomerData;
12+
use Magento\Framework\App\ObjectManager;
1313
use PHPUnit\Framework\TestCase;
1414
use ReflectionClass;
1515

@@ -75,40 +75,48 @@ public function dataProviderInputData(): array
7575
{
7676
return [
7777
[
78-
['customer' =>
79-
[
78+
['customer' => [
8079
'id' => -1,
8180
'Id' => 1,
82-
'name' =>
83-
[
81+
'name' => [
8482
'firstName' => 'Test',
8583
'LastName' => 'user'
8684
],
8785
'isHavingOwnHouse' => 1,
88-
'address' =>
89-
[
86+
'address' => [
9087
'street' => '1st Street',
9188
'Street' => '3rd Street',
9289
'city' => 'London'
9390
],
9491
]
9592
],
96-
['customer' =>
97-
[
93+
['customer' => [
9894
'id' => -1,
99-
'name' =>
100-
[
95+
'name' => [
10196
'firstName' => 'Test',
10297
'LastName' => 'user'
10398
],
10499
'isHavingOwnHouse' => 1,
105-
'address' =>
106-
[
100+
'address' => [
107101
'street' => '1st Street',
108102
'city' => 'London'
109103
],
110104
]
111105
],
106+
['customer' => [
107+
'id' => -1,
108+
'_Id' => 1,
109+
'name' => [
110+
'firstName' => 'Test',
111+
'LastName' => 'user'
112+
],
113+
'isHavingOwnHouse' => 1,
114+
'address' => [
115+
'street' => '1st Street',
116+
'city' => 'London'
117+
],
118+
]
119+
],
112120
]
113121
];
114122
}

‎app/code/Magento/EncryptionKey/Model/ResourceModel/Key/Change.php

Lines changed: 38 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,22 @@
55
*/
66
namespace Magento\EncryptionKey\Model\ResourceModel\Key;
77

8+
use \Exception;
9+
use Magento\Config\Model\Config\Backend\Encrypted;
10+
use Magento\Config\Model\Config\Structure;
11+
use Magento\Framework\App\DeploymentConfig\Writer;
812
use Magento\Framework\App\Filesystem\DirectoryList;
913
use Magento\Framework\Config\ConfigOptionsListConstants;
1014
use Magento\Framework\Config\Data\ConfigData;
1115
use Magento\Framework\Config\File\ConfigFilePool;
16+
use Magento\Framework\Encryption\EncryptorInterface;
17+
use Magento\Framework\Exception\FileSystemException;
18+
use Magento\Framework\Exception\LocalizedException;
19+
use Magento\Framework\Filesystem;
20+
use Magento\Framework\Filesystem\Directory\WriteInterface;
21+
use Magento\Framework\Math\Random;
22+
use Magento\Framework\Model\ResourceModel\Db\AbstractDb;
23+
use Magento\Framework\Model\ResourceModel\Db\Context;
1224

1325
/**
1426
* Encryption key changer resource model
@@ -19,60 +31,60 @@
1931
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
2032
* @since 100.0.2
2133
*/
22-
class Change extends \Magento\Framework\Model\ResourceModel\Db\AbstractDb
34+
class Change extends AbstractDb
2335
{
2436
/**
2537
* Encryptor interface
2638
*
27-
* @var \Magento\Framework\Encryption\EncryptorInterface
39+
* @var EncryptorInterface
2840
*/
2941
protected $encryptor;
3042

3143
/**
3244
* Filesystem directory write interface
3345
*
34-
* @var \Magento\Framework\Filesystem\Directory\WriteInterface
46+
* @var WriteInterface
3547
*/
3648
protected $directory;
3749

3850
/**
3951
* System configuration structure
4052
*
41-
* @var \Magento\Config\Model\Config\Structure
53+
* @var Structure
4254
*/
4355
protected $structure;
4456

4557
/**
4658
* Configuration writer
4759
*
48-
* @var \Magento\Framework\App\DeploymentConfig\Writer
60+
* @var Writer
4961
*/
5062
protected $writer;
5163

5264
/**
53-
* Random
65+
* Random string generator
5466
*
55-
* @var \Magento\Framework\Math\Random
67+
* @var Random
5668
* @since 100.0.4
5769
*/
5870
protected $random;
5971

6072
/**
61-
* @param \Magento\Framework\Model\ResourceModel\Db\Context $context
62-
* @param \Magento\Framework\Filesystem $filesystem
63-
* @param \Magento\Config\Model\Config\Structure $structure
64-
* @param \Magento\Framework\Encryption\EncryptorInterface $encryptor
65-
* @param \Magento\Framework\App\DeploymentConfig\Writer $writer
66-
* @param \Magento\Framework\Math\Random $random
73+
* @param Context $context
74+
* @param Filesystem $filesystem
75+
* @param Structure $structure
76+
* @param EncryptorInterface $encryptor
77+
* @param Writer $writer
78+
* @param Random $random
6779
* @param string $connectionName
6880
*/
6981
public function __construct(
70-
\Magento\Framework\Model\ResourceModel\Db\Context $context,
71-
\Magento\Framework\Filesystem $filesystem,
72-
\Magento\Config\Model\Config\Structure $structure,
73-
\Magento\Framework\Encryption\EncryptorInterface $encryptor,
74-
\Magento\Framework\App\DeploymentConfig\Writer $writer,
75-
\Magento\Framework\Math\Random $random,
82+
Context $context,
83+
Filesystem $filesystem,
84+
Structure $structure,
85+
EncryptorInterface $encryptor,
86+
Writer $writer,
87+
Random $random,
7688
$connectionName = null
7789
) {
7890
$this->encryptor = clone $encryptor;
@@ -98,20 +110,18 @@ protected function _construct()
98110
*
99111
* @param string|null $key
100112
* @return null|string
101-
* @throws \Exception
113+
* @throws FileSystemException|LocalizedException|Exception
102114
*/
103115
public function changeEncryptionKey($key = null)
104116
{
105117
// prepare new key, encryptor and new configuration segment
106118
if (!$this->writer->checkIfWritable()) {
107-
throw new \Exception(__('Deployment configuration file is not writable.'));
119+
throw new FileSystemException(__('Deployment configuration file is not writable.'));
108120
}
109121

110122
if (null === $key) {
111-
// md5() here is not for cryptographic use. It used for generate encryption key itself
112-
// and do not encrypt any passwords
113-
// phpcs:ignore Magento2.Security.InsecureFunction
114-
$key = md5($this->random->getRandomString(ConfigOptionsListConstants::STORE_KEY_RANDOM_STRING_SIZE));
123+
$key = ConfigOptionsListConstants::STORE_KEY_ENCODED_RANDOM_STRING_PREFIX .
124+
$this->random->getRandomBytes(ConfigOptionsListConstants::STORE_KEY_RANDOM_STRING_SIZE);
115125
}
116126
$this->encryptor->setNewKey($key);
117127

@@ -128,7 +138,7 @@ public function changeEncryptionKey($key = null)
128138
$this->writer->saveConfig($configData);
129139
$this->commit();
130140
return $key;
131-
} catch (\Exception $e) {
141+
} catch (LocalizedException $e) {
132142
$this->rollBack();
133143
throw $e;
134144
}
@@ -142,11 +152,11 @@ public function changeEncryptionKey($key = null)
142152
protected function _reEncryptSystemConfigurationValues()
143153
{
144154
// look for encrypted node entries in all system.xml files
145-
/** @var \Magento\Config\Model\Config\Structure $configStructure */
155+
/** @var Structure $configStructure */
146156
$configStructure = $this->structure;
147157
$paths = $configStructure->getFieldPathsByAttribute(
148158
'backend_model',
149-
\Magento\Config\Model\Config\Backend\Encrypted::class
159+
Encrypted::class
150160
);
151161

152162
// walk through found data and re-encrypt it

‎app/code/Magento/EncryptionKey/Test/Unit/Model/ResourceModel/Key/ChangeTest.php

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
use Magento\EncryptionKey\Model\ResourceModel\Key\Change;
1212
use Magento\Framework\App\DeploymentConfig\Writer;
1313
use Magento\Framework\App\ResourceConnection;
14+
use Magento\Framework\Config\ConfigOptionsListConstants;
1415
use Magento\Framework\DB\Adapter\AdapterInterface;
1516
use Magento\Framework\DB\Select;
1617
use Magento\Framework\Encryption\EncryptorInterface;
@@ -148,16 +149,19 @@ private function setUpChangeEncryptionKey()
148149
public function testChangeEncryptionKey()
149150
{
150151
$this->setUpChangeEncryptionKey();
151-
$this->randomMock->expects($this->never())->method('getRandomString');
152+
$this->randomMock->expects($this->never())->method('getRandomBytes');
152153
$key = 'key';
153154
$this->assertEquals($key, $this->model->changeEncryptionKey($key));
154155
}
155156

156157
public function testChangeEncryptionKeyAutogenerate()
157158
{
158159
$this->setUpChangeEncryptionKey();
159-
$this->randomMock->expects($this->once())->method('getRandomString')->willReturn('abc');
160-
$this->assertEquals(hash('md5', 'abc'), $this->model->changeEncryptionKey());
160+
$this->randomMock->expects($this->once())->method('getRandomBytes')->willReturn('abc');
161+
$this->assertEquals(
162+
ConfigOptionsListConstants::STORE_KEY_ENCODED_RANDOM_STRING_PREFIX . 'abc',
163+
$this->model->changeEncryptionKey()
164+
);
161165
}
162166

163167
public function testChangeEncryptionKeyThrowsException()

‎app/code/Magento/PageCache/Controller/Block.php

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,16 @@
44
* Copyright © Magento, Inc. All rights reserved.
55
* See COPYING.txt for license details.
66
*/
7+
declare(strict_types=1);
8+
79
namespace Magento\PageCache\Controller;
810

911
use Magento\Framework\Serialize\Serializer\Base64Json;
1012
use Magento\Framework\Serialize\Serializer\Json;
1113
use Magento\Framework\Validator\RegexFactory;
1214
use Magento\Framework\App\ObjectManager;
1315
use Magento\Framework\View\Layout\LayoutCacheKeyInterface;
16+
use Magento\Framework\App\Config\ScopeConfigInterface;
1417

1518
abstract class Block extends \Magento\Framework\App\Action\Action
1619
{
@@ -51,21 +54,33 @@ abstract class Block extends \Magento\Framework\App\Action\Action
5154
*/
5255
private const VALIDATION_RULE_PATTERN = '/^[a-z0-9]+[a-z0-9_]*$/i';
5356

57+
/**
58+
* @var ScopeConfigInterface
59+
*/
60+
private $config;
61+
62+
/**
63+
* Handle size system name
64+
*/
65+
private const XML_HANDLES_SIZE = 'system/full_page_cache/handles_size';
66+
5467
/**
5568
* @param \Magento\Framework\App\Action\Context $context
5669
* @param \Magento\Framework\Translate\InlineInterface $translateInline
5770
* @param Json $jsonSerializer
5871
* @param Base64Json $base64jsonSerializer
5972
* @param LayoutCacheKeyInterface $layoutCacheKey
6073
* @param RegexFactory|null $regexValidatorFactory
74+
* @param ScopeConfigInterface|null $scopeConfig
6175
*/
6276
public function __construct(
6377
\Magento\Framework\App\Action\Context $context,
6478
\Magento\Framework\Translate\InlineInterface $translateInline,
6579
Json $jsonSerializer = null,
6680
Base64Json $base64jsonSerializer = null,
6781
LayoutCacheKeyInterface $layoutCacheKey = null,
68-
?RegexFactory $regexValidatorFactory = null
82+
?RegexFactory $regexValidatorFactory = null,
83+
ScopeConfigInterface $scopeConfig = null
6984
) {
7085
parent::__construct($context);
7186
$this->translateInline = $translateInline;
@@ -77,6 +92,7 @@ public function __construct(
7792
?: ObjectManager::getInstance()->get(LayoutCacheKeyInterface::class);
7893
$this->regexValidatorFactory = $regexValidatorFactory
7994
?: ObjectManager::getInstance()->get(RegexFactory::class);
95+
$this->config = $scopeConfig;
8096
}
8197

8298
/**
@@ -94,6 +110,11 @@ protected function _getBlocks()
94110
}
95111
$blocks = $this->jsonSerializer->unserialize($blocks);
96112
$handles = $this->base64jsonSerializer->unserialize($handles);
113+
114+
$handleSize = (int) $this->config->getValue(self::XML_HANDLES_SIZE);
115+
$handles = ($handleSize && count($handles) > $handleSize)
116+
? array_splice($handles, 0, $handleSize) : $handles;
117+
97118
if (!$this->validateHandleParam($handles)) {
98119
return [];
99120
}

‎app/code/Magento/PageCache/etc/adminhtml/system.xml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,10 @@
7878
<comment>Public content cache lifetime in seconds. If field is empty default value 86400 will be saved. </comment>
7979
<backend_model>Magento\PageCache\Model\System\Config\Backend\Ttl</backend_model>
8080
</field>
81+
<field id="handles_size" type="text" translate="label comment" sortOrder="5" showInDefault="1" canRestore="1">
82+
<label>Handles params size</label>
83+
<comment>Handles params size. For better performance use handles parameter size between 50 and 100. </comment>
84+
</field>
8185
</group>
8286
</section>
8387
</system>

‎app/code/Magento/PageCache/etc/config.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
<path>varnish4.vcl</path>
2525
</varnish4>
2626
<ttl>86400</ttl>
27+
<handles_size>100</handles_size>
2728
<caching_application>1</caching_application>
2829
<default>
2930
<access_list>localhost</access_list>

‎app/code/Magento/PageCache/etc/di.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
<type name="Magento\PageCache\Controller\Block">
3636
<arguments>
3737
<argument name="layoutCacheKey" xsi:type="object">Magento\Framework\View\Layout\LayoutCacheKeyInterface</argument>
38+
<argument name="scopeConfig" xsi:type="object">Magento\Framework\App\Config\ScopeConfigInterface\Proxy</argument>
3839
</arguments>
3940
</type>
4041
<type name="Magento\Framework\App\Cache\RuntimeStaleCacheStateModifier">

0 commit comments

Comments
 (0)