Problem/Motivation
When viewing the help page for the "Allowed upload extensions" check at `/admin/reports/security-review/help/security_review/allowed_upload_extensions`, a white screen error occurs with the following exception:
Symfony\Component\Routing\Exception\MissingMandatoryParametersException:
Some mandatory parameters are missing ("storage_type") to generate a URL for route "entity.field_config.storage_field_edit_form".
This happens because the `UploadExtensions::getDetails()` method attempts to generate edit links for field configurations. When the link is rendered, some entity types (such as `group`, `paragraph`, etc.) require a `storage_type` route parameter that isn't being provided.
The code currently catches `RouteNotFoundException` but not `MissingMandatoryParametersException`, and the exception occurs during the rendering phase rather than the link creation phase.
Steps to reproduce
- Install Security Review module on a site with custom entity types (e.g., Group module, Paragraphs)
- Visit `/admin/reports/security-review/help/security_review/allowed_upload_extensions`
- Observe white screen error with `MissingMandatoryParametersException`
Proposed resolution
Update the `UploadExtensions::getDetails()` method to:
- Add `MissingMandatoryParametersException` to the catch block
- Test URL generation **before** creating the Link object to ensure exceptions are caught during the try block
- Fall back to plain text output when URL generation fails
This follows the same pattern used in #2988514: Field check gets fatal error when using Paragraphs (or other entity without edit or canonical routes).
Changes needed in `src/Plugin/SecurityCheck/UploadExtensions.php`:
- Add `use Symfony\Component\Routing\Exception\MissingMandatoryParametersException;`
- Update both try-catch blocks to test URL generation before creating links
- Catch both `RouteNotFoundException` and `MissingMandatoryParametersException`
Remaining tasks
- [ ] Fix the issue
- [ ] Attach a patch/MR
- [ ] Review the fix
- [ ] Commit the fix
User interface changes
None
API changes
None
Data model changes
None
Issue fork security_review-3557440
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #2
the_g_bomb commentedComment #4
smustgrave commentedThis module is lacking test coverage so want to start doing better with that.
Comment #5
smustgrave commentedActually not able to replicate this mind providing additional steps.
Comment #6
the_g_bomb commentedApologies, I will ensure I can replicate with a clean install and add steps if I find them. I guess it is possible that it could be content related.
Comment #7
smustgrave commentedNo worries! Want to make sure we get it fixed
Comment #8
smustgrave commentedwhat may help is the scenario that's causing the security_review failure. Think maybe default it's fine but may need to trigger a finding.
Comment #10
smustgrave commentedCleaned up a bit, but don't mind adding the addition catch case if it helps others.