AC-6049: Filtering inputs handler in page_cache/block controller

Author: Rizwan

app/code/Magento/PageCache/Controller/Block.php

@@ -9,6 +9,8 @@
 
 use Magento\Framework\Serialize\Serializer\Base64Json;
 use Magento\Framework\Serialize\Serializer\Json;
+use Magento\Framework\Validator\RegexFactory;
+use Magento\Framework\App\ObjectManager;
 use Magento\Framework\View\Layout\LayoutCacheKeyInterface;
 
 abstract class Block extends \Magento\Framework\App\Action\Action
@@ -40,6 +42,11 @@ abstract class Block extends \Magento\Framework\App\Action\Action
      */
     private $layoutCacheKeyName = 'mage_pagecache';
 
+    /**
+     * @var RegexFactory
+     */
+    private $regexValidatorFactory;
+
     /**
      * @param \Magento\Framework\App\Action\Context $context
      * @param \Magento\Framework\Translate\InlineInterface $translateInline
@@ -57,11 +64,12 @@ public function __construct(
         parent::__construct($context);
         $this->translateInline = $translateInline;
         $this->jsonSerializer = $jsonSerializer
-            ?: \Magento\Framework\App\ObjectManager::getInstance()->get(Json::class);
+            ?: ObjectManager::getInstance()->get(Json::class);
         $this->base64jsonSerializer = $base64jsonSerializer
-            ?: \Magento\Framework\App\ObjectManager::getInstance()->get(Base64Json::class);
+            ?: ObjectManager::getInstance()->get(Base64Json::class);
         $this->layoutCacheKey = $layoutCacheKey
-            ?: \Magento\Framework\App\ObjectManager::getInstance()->get(LayoutCacheKeyInterface::class);
+            ?: ObjectManager::getInstance()->get(LayoutCacheKeyInterface::class);
+        $this->regexValidatorFactory = ObjectManager::getInstance()->get(RegexFactory::class);
     }
 
     /**
@@ -79,6 +87,9 @@ protected function _getBlocks()
         }
         $blocks = $this->jsonSerializer->unserialize($blocks);
         $handles = $this->base64jsonSerializer->unserialize($handles);
+        if (!$this->validateHandleParam($handles)) {
+            return [];
+        }
 
         $layout = $this->_view->getLayout();
         $this->layoutCacheKey->addCacheKeys($this->layoutCacheKeyName);
@@ -95,4 +106,21 @@ protected function _getBlocks()
 
         return $data;
     }
+
+    /**
+     * Validates handles parameter
+     *
+     * @param $handles array
+     * @return bool
+     */
+    private function validateHandleParam($handles) {
+        $validator = $this->regexValidatorFactory->create(['pattern' => '/^[a-z]+[a-z0-9_]*$/i']);
+        foreach ($handles as $handle) {
+            if (!$validator->isValid($handle)) {
+                return false;
+            }
+        }
+
+        return true;
+    }
 }