Problem/Motivation

There are security problems when using serialized arrays in PHP code.
JSON data storage is a requirement of Drupal 10: https://www.drupal.org/node/3192484

Proposed resolution

Change all stored data to use JSON instead of serialized arrays.

Remaining tasks

  • Convert to JSON data storage.
  • Update D7 migrations to support JSON for compatibility with #3273408.
  • Confirm test coverage for entity data stored in both the v1 and v2 field formats.
  • Add an update script to update stored entity data.
  • Add test coverage for the update script.

User interface changes

None.

API changes

TBD

Data model changes

TBD

CommentFileSizeAuthor
#44 metatag-n3272768-44.patch26.36 KBDamienMcKenna
#42 metatag-n3272768-42.patch23.46 KBDamienMcKenna
#42 metatag-n3272768-42.interdiff.txt2.51 KBDamienMcKenna
#37 metatag-n3272768-37.patch21.29 KBDamienMcKenna
#34 metatag-n3272768-34.interdiff.txt1.02 KBDamienMcKenna
#34 metatag-n3272768-34.patch22.22 KBDamienMcKenna
#33 metatag-n3272768-33.patch22.21 KBDamienMcKenna
#33 metatag-n3272768-33.interdiff.txt6.42 KBDamienMcKenna
#32 metatag-n3272768-32.patch17.03 KBDamienMcKenna
#32 metatag-n3272768-32.interdiff.txt4.4 KBDamienMcKenna
#30 metatag-n3272768-30.patch15.93 KBDamienMcKenna
#30 metatag-n3272768-30.interdiff.txt2.13 KBDamienMcKenna
#28 metatag-n3272768-28.patch15.25 KBDamienMcKenna
#28 metatag-n3272768-28.interdiff.txt1.97 KBDamienMcKenna
#27 metatag-n3272768-27.interdiff.txt442 bytesDamienMcKenna
#27 metatag-n3272768-27.patch13.53 KBDamienMcKenna
#25 metatag-n3272768-25.patch13.1 KBDamienMcKenna
#25 metatag-n3272768-25.interdiff.txt397 bytesDamienMcKenna
#22 metatag-n3272768-22.patch12.71 KBDamienMcKenna
#19 metatag-n3272768-20.patch15.55 KBDamienMcKenna
#18 metatag-n3272768-18.patch15.2 KBDamienMcKenna
#18 metatag-n3272768-18.interdiff.txt10.78 KBDamienMcKenna
#14 metatag-n3272768-14.patch12.77 KBDamienMcKenna
#14 metatag-n3272768-14.interdiff.txt871 bytesDamienMcKenna
#12 metatag-n3272768-12.patch11.92 KBDamienMcKenna
#12 metatag-n3272768-12.interdiff.txt4.7 KBDamienMcKenna
#11 metatag-n3272768-10.patch729 bytesSandeepSingh199
#11 interdiff_9_10.txt6.29 KBSandeepSingh199
#9 metatag-n3272768-9.patch7.21 KBDamienMcKenna
#6 metatag-n3272768-6.patch10.21 KBDamienMcKenna

Issue fork metatag-3272768

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

DamienMcKenna created an issue. See original summary.

DamienMcKenna’s picture

Could/should we do this on D7 too?

DamienMcKenna’s picture

DamienMcKenna’s picture

FYI the TMGMT module made this change: #3065597

DamienMcKenna’s picture

Title: Convert to JSON data storage » Convert to JSON data storage (D9)
DamienMcKenna’s picture

FileSize
10.21 KB

WIP, untested.

DamienMcKenna’s picture

I think we should go the additional step and store the data as a JSON field rather than just store it as a different string format, that would give us the most benefit.

DamienMcKenna’s picture

The migration logic needs to support both Metatag 7.x-1-x-style serialized arrays and Metatag 7.x-2.x-style JSON data.

DamienMcKenna’s picture

Status: Active » Needs review
FileSize
7.21 KB

Some fixes.

Status: Needs review » Needs work

The last submitted patch, 9: metatag-n3272768-9.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

SandeepSingh199’s picture

Status: Needs work » Needs review
FileSize
6.29 KB
729 bytes

fixed the #9 php error. also attached interdiff_9_10.txt

DamienMcKenna’s picture

This should fix some of the test failures.

Status: Needs review » Needs work

The last submitted patch, 12: metatag-n3272768-12.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

DamienMcKenna’s picture

Status: Needs work » Needs review
FileSize
871 bytes
12.77 KB

This should fix the last error.

DamienMcKenna’s picture

Assigned: DamienMcKenna » Unassigned
Issue summary: View changes
Status: Needs review » Needs work

Excellent.

I've updated the Remaining Tasks list:

  • Update D7 migrations to support JSON for compatibility with #3273408.
  • Add an update script to update existing configuration.
  • Add an update script to update stored entity data.
DamienMcKenna’s picture

Issue summary: View changes

Note: this doesn't change the underlying field itself, it just changes how the data is stored in the field.

DamienMcKenna’s picture

Did some manual testing and it works well, it's nice having the data stored in JSON format instead of serialized arrays.

DamienMcKenna’s picture

Status: Needs work » Needs review
FileSize
10.78 KB
15.2 KB

Seeing how this would work if it didn't serialize the data..

DamienMcKenna’s picture

DamienMcKenna’s picture

I suspect we might need #3320031: Add a new field for storing raw JSON data (D9) before we can handle JSON all the way down..

Status: Needs review » Needs work

The last submitted patch, 19: metatag-n3272768-20.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

DamienMcKenna’s picture

Status: Needs work » Needs review
FileSize
12.71 KB

This is #14 rerolled, with a fix for an unwanted second argument to Json::decode().

Status: Needs review » Needs work

The last submitted patch, 22: metatag-n3272768-22.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

DamienMcKenna’s picture

Assigned: Unassigned » DamienMcKenna

Status: Needs review » Needs work

The last submitted patch, 25: metatag-n3272768-25.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

DamienMcKenna’s picture

Status: Needs work » Needs review
FileSize
13.53 KB
442 bytes

One more..

DamienMcKenna’s picture

Woot.

Let's set up the D7 migration to have a JSON-encoded value alongside a serialized value.

Status: Needs review » Needs work

The last submitted patch, 28: metatag-n3272768-28.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

DamienMcKenna’s picture

Status: Needs work » Needs review
FileSize
2.13 KB
15.93 KB

Offload the migration decoder logic to a separate method, and mirror the code from D7.

DamienMcKenna’s picture

Issue summary: View changes

Nice!

That's two items down, now to do update scripts.

DamienMcKenna’s picture

Let's make backwards compatibility a little easier by adding the same global function that the D7 issue uses. Yes, a function.

DamienMcKenna’s picture

WIP update script, not running the tests because there's no test coverage for that bit yet. This also reverts the changes to the info file.

DamienMcKenna’s picture

DamienMcKenna’s picture

Issue summary: View changes

After doing some testing I've confirmed that on D8+ the configuration items do not need to be modified, they're stored as a single object with multiple values in the "tags" element instead of those values being stored as a serialized array. That means we don't need to update the configuration. Woot.

DamienMcKenna’s picture

Version: 8.x-1.x-dev » 2.0.x-dev
DamienMcKenna’s picture

Status: Needs review » Needs work

The last submitted patch, 37: metatag-n3272768-37.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

DamienMcKenna’s picture

The test failures are because of WebProfiler, see #3323467 for details.

All that's left is to finish up the update script.

DamienMcKenna’s picture

Issue summary: View changes

I think we need test coverage to make sure that data loads correctly in both the v1 and v2 field formats, to make sure that sites don't break while the update scripts are running.

DamienMcKenna’s picture

Issue summary: View changes

We need test coverage for the update script too.

DamienMcKenna’s picture

Status: Needs work » Needs review
FileSize
2.51 KB
23.46 KB

Fixed update script.

DamienMcKenna’s picture

I can't upload the tests for the update script because it includes a fixture that has a change to the "entity.definitions.installed" and "entity.definitions.installed" key_value records, which include serialized objects, and git thinks the files are binaries and won't output them in the patch file.

DamienMcKenna’s picture

DamienMcKenna’s picture

And the tests pass! Woot!

DamienMcKenna’s picture

Status: Needs review » Fixed

Committed.

DamienMcKenna’s picture

Assigned: DamienMcKenna » Unassigned

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.