WPP-Public / akqa-nz-silverstripe-responsive-images

Provides support for configurable sets of responsive images using Javascript
GNU General Public License v2.0
54 stars 26 forks source link

[SS5.2.x] Uncaught InvalidArgumentException: Can not collapse relative folders #39

Closed Firesphere closed 4 months ago

Firesphere commented 4 months ago

On SS5.2.0 (and I assume up), this module breaks, throwing the following error:

[Emergency] Uncaught InvalidArgumentException: Can not collapse relative folders
GET /?flush=all

Line 38 in /var/www/html/vendor/silverstripe/framework/src/Core/Path.php
Source

29             $parts = $parts[0];
30         }
31 
32         // Cleanup and join all parts
33         $parts = array_filter(array_map('trim', array_filter($parts ?? [])));
34         $fullPath = static::normalise(implode(DIRECTORY_SEPARATOR, $parts));
35 
36         // Protect against directory traversal vulnerability (OTG-AUTHZ-001)
37         if (strpos($fullPath ?? '', '..') !== false) {
38             throw new InvalidArgumentException('Can not collapse relative folders');
39         }
40 
41         return $fullPath ?: DIRECTORY_SEPARATOR;
42     }
43 
44     /**

Trace

    SilverStripe\Core\Path::join(Uploads/Elements/Features, Screenshot-2023-03-02-at-21-25-59-CSP-Can-I-use...-Support-tables-for-HTML5-CSS3-etc)
    AbstractFileIDHelper.php:100
    SilverStripe\Assets\FilenameParsing\AbstractFileIDHelper->swapExtension(Uploads/Elements/Features/Screenshot-2023-03-02-at-21-25-59-CSP-Can-I-use...-Support-tables-for-HTML5-CSS3-etc.png, FocusFillWyIwLjAwIiwiMC4wMCIsMTkyMCwxMDgwXQ, 1)
    AbstractFileIDHelper.php:44
    SilverStripe\Assets\FilenameParsing\AbstractFileIDHelper->buildFileID(Uploads/Elements/Features/Screenshot-2023-03-02-at-21-25-59-CSP-Can-I-use...-Support-tables-for-HTML5-CSS3-etc.png, eabb96aa34846c8e84c9147dbd23818ad2d72e5f, FocusFillWyIwLjAwIiwiMC4wMCIsMTkyMCwxMDgwXQ)
    FileIDHelperResolutionStrategy.php:394
    SilverStripe\Assets\FilenameParsing\FileIDHelperResolutionStrategy->buildFileID(SilverStripe\Assets\FilenameParsing\ParsedFileID)
    FlysystemAssetStore.php:275
    SilverStripe\Assets\Flysystem\FlysystemAssetStore->applyToFileOnFilesystem(Closure, SilverStripe\Assets\FilenameParsing\ParsedFileID)
    FlysystemAssetStore.php:1117
    SilverStripe\Assets\Flysystem\FlysystemAssetStore->exists(Uploads/Elements/Features/Screenshot-2023-03-02-at-21-25-59-CSP-Can-I-use...-Support-tables-for-HTML5-CSS3-etc.png, eabb96aa34846c8e84c9147dbd23818ad2d72e5f, FocusFillWyIwLjAwIiwiMC4wMCIsMTkyMCwxMDgwXQ)
    ImageManipulation.php:956
    SilverStripe\Assets\File->manipulate(FocusFillWyIwLjAwIiwiMC4wMCIsMTkyMCwxMDgwXQ, Closure)
    ImageManipulation.php:866
    SilverStripe\Assets\File->manipulateImage(FocusFillWyIwLjAwIiwiMC4wMCIsMTkyMCwxMDgwXQ, Closure)
    FocusPointExtension.php:152
    JonoM\FocusPoint\Extensions\FocusPointExtension->manipulateImageCropData(FocusFillWyIwLjAwIiwiMC4wMCIsMTkyMCwxMDgwXQ, Array)
    FocusPointExtension.php:109
    JonoM\FocusPoint\Extensions\FocusPointExtension->FocusFill(1920, 1080)
    call_user_func_array(Array, Array)
    Extensible.php:135
    SilverStripe\View\ViewableData->SilverStripe\Core\{closure}(SilverStripe\Assets\Image, Array)
    CustomMethods.php:64
    SilverStripe\View\ViewableData->__call(FocusFill, Array)
    call_user_func_array(Array, Array)
    ResponsiveImageExtension.php:157
    Heyday\ResponsiveImages\ResponsiveImageExtension->getResampledImage(FocusFill, Array)
    ResponsiveImageExtension.php:128
    Heyday\ResponsiveImages\ResponsiveImageExtension->createResponsiveSet(Array, Array, responsiveset1)
    ResponsiveImageExtension.php:75
    Heyday\ResponsiveImages\ResponsiveImageExtension->__call(responsiveset1, Array)
    call_user_func_array(Array, Array)
    Extensible.php:135
    SilverStripe\View\ViewableData->SilverStripe\Core\{closure}(SilverStripe\Assets\Image, Array)
    CustomMethods.php:64
    SilverStripe\View\ViewableData->__call(ResponsiveSet1, Array)

I'm certain it's this module, as removing it makes everything work just fine again.

Composer requirements for this specific project:

        "php": "^8.1",
        "silverstripe/recipe-plugin": "^1.2|^2",
        "silverstripe/recipe-cms": "^4.12|^5",
        "silverstripe/login-forms": "^4.8|^5",
        "silverstripe/elemental-bannerblock": "^2.0|^3",
        "silverstripe/googlesitemaps": "^2|^3",
        "silverstripe/mfa": "^4|^5",
        "silverstripe/totp-authenticator": "^4|^5",
        "silverstripe/webauthn-authenticator": "^4|^5",
        "jonom/silverstripe-betternavigator": "^5|^6",
        "dnadesign/silverstripe-elemental-virtual": "^1|^2",
        "elliotsawyer/silverstripe-matomo": "^0.0.1|dev-master",
        "heyday/silverstripe-responsive-images": "^3.0|^4",
        "axllent/silverstripe-weblog": "^1.4.0",
        "dynamic/silverstripe-elemental-features": "^3.0|^4",
        "phptek/sentry": "^4|^5",
        "colymba/gridfield-bulk-editing-tools": "^4",
        "firesphere/cspheaders": "^1",
        "3dgoo/silverstripe-hcaptcha": "^1.0|^2",
        "arillo/silverstripe-multiselectfield": "dev-main",
        "silverstripe/sharedraftcontent": "^2.8|^3",
        "firesphere/silverstripe-geshiparser": "dev-main",
        "firesphere/multicolumn-element": ">=0.2",
        "jonom/silverstripe-environment-awareness": "^2.0|^3",
        "firesphere/elastic-search": "^1",
        "firesphere/haveibeenpwnd": "^2.1.0",
        "heyday/silverstripe-colorpalette": "^2.1|^3",
        "jonom/focuspoint": "^4.0|^5",
        "firesphere/module-helpers": "*",
        "firesphere/adblockwarning": "dev-main",
        "silverstripe/tagfield": "^3.1",
        "elasticsearch/elasticsearch": "^8.10",
        "elastic/enterprise-search": "^8.10",
        "symbiote/silverstripe-queuedjobs": "^4|^5"

None of the requirements break the site, except for this one.

xini commented 4 months ago

I use this module in production on multiple SS 5.2 sites without issues, including "jonom/focuspoint".

What is your responsive image config?

What version of SS and the modules is actually installed? It looks like your composer.json allows SS 4 and 5?

Firesphere commented 4 months ago

Ignore the pre-5 sets. That's for when I was upgrading to 5, and couldn't bother removing. It works fine with 5.1, it breaks on 5.2, with the error above.

Here you go:

---
After: 'silverstripe-responsive-images/*'
---
Heyday\ResponsiveImages\ResponsiveImageExtension:
  sets:
    ResponsiveSet1:
      method: FocusFill
      arguments:
        '(min-width: 1000px) and (min-device-pixel-ratio: 2.0)': [ 1920, 1080 ]
        '(min-width: 1000px)': [ 1024, 576 ]
        '(min-width: 800px) and (min-device-pixel-ratio: 2.0)': [ 1366, 768 ]
        '(min-width: 800px)': [ 960, 540 ]
        '(min-width: 600px) and (min-device-pixel-ratio: 2.0)': [ 1280, 720 ]
        '(min-width: 600px)': [ 640, 360 ]
      default_arguments: [ 1280, 720 ]
3dgoo/silverstripe-hcaptcha               2.0.2              A spam protector and form field using hCaptcha
arillo/silverstripe-cms-alpine            dev-main 848add1   Makes alpinejs available in silverstripe CMS
arillo/silverstripe-multiselectfield      dev-main 6bae2b4   A sortable multiple select field for managing many-to-many relations
asyncphp/doorman                          4.0.0              Child process management
axllent/silverstripe-weblog               1.4.3              A blog module for Silverstripe
brick/math                                0.12.1             Arbitrary-precision arithmetic library
clue/stream-filter                        v1.7.0             A simple and modern approach to stream filtering in PHP
colymba/gridfield-bulk-editing-tools      4.0.2              SilverStripe GridField component to upload images/files and edit records in bulk
composer/ca-bundle                        1.5.0              Lets you find a path to the system CA bundle, and includes a fallback to the Mozilla CA bundle.
composer/installers                       v2.2.0             A multi-framework Composer library installer
composer/package-versions-deprecated      1.11.99.5          Composer plugin that provides efficient querying for installed package versions (no runtime IO)
composer/pcre                             3.1.3              PCRE wrapping library that offers type-safe preg_* replacements.
composer/semver                           3.4.0              Semver library that offers utilities, version constraint parsing and validation.
composer/xdebug-handler                   3.0.4              Restarts a process without Xdebug.
defuse/php-encryption                     v2.4.0             Secure PHP Encryption Library
dnadesign/silverstripe-elemental          5.2.0              Elemental pagetype and collection of Elements
dnadesign/silverstripe-elemental-virtual  2.1.0              Adds ability for Elemental to share content blocks between pages
doctrine/deprecations                     1.1.3              A small layer on top of trigger_error(E_USER_DEPRECATED) or PSR-3 logging with options to disable all deprecations or selectively for packages.
doctrine/instantiator                     2.0.0              A small, lightweight utility to instantiate objects in PHP without invoking their constructors
doctrine/lexer                            3.0.1              PHP Doctrine Lexer parser library that can be used in Top-Down, Recursive Descent Parsers.
dynamic/silverstripe-elemental-baseobject 4.0.0-beta2        A simple base DataObject to use with Elemental Content Blocks
dynamic/silverstripe-elemental-features   4.0.1              A block that displays featured content - large image, title, description and link.
egulias/email-validator                   4.0.2              A library for validating emails against several RFCs
elastic/enterprise-search                 v8.10.0            Enterprise Search official PHP client
elastic/transport                         v8.8.0             HTTP transport PHP library for Elastic products
elasticsearch/elasticsearch               v8.13.0            PHP Client for Elasticsearch
elliotsawyer/silverstripe-matomo          dev-master d0d6b5c Install Matomo analytics tracking on your SilverStripe website
embed/embed                               v4.4.10            PHP library to retrieve page info using oembed, opengraph, etc
firesphere/adblockwarning                 dev-main 0b08aa0   Show a warning to visitors that don't have an adblocker installed
firesphere/cspheaders                     1.7.2              Setup CSP Headers for a website
firesphere/elastic-search                 1.2.0              Search a SilverStripe site with Elastic Enterprise or Elastic search
firesphere/haveibeenpwnd                  2.1.0              Check if a user password is found in the Have I Been Pwned database.
firesphere/module-helpers                 0.4.0              A set of helpers for Sentry in JS etc.
firesphere/multicolumn-element            0.4                Silverstripe Elemental configurable width two-columns
firesphere/rangefield                     1.2.0              Range selector for SilverStripe
firesphere/searchbackend                  1.1.1              Common codebase for searching with Solr
firesphere/silverstripe-geshiparser       dev-main d37962d   Parse [code] blocks from the Content in SilverStripe
friendsofphp/php-cs-fixer                 v3.54.0            A tool to automatically fix PHP code style
geshi/geshi                               v1.0.9.1           Generic Syntax Highlighter
giggsey/libphonenumber-for-php            8.13.35            PHP Port of Google's libphonenumber
giggsey/locale                            2.6                Locale functions required by libphonenumber-for-php
gorriecoe/silverstripe-link               1.5.1              Adds a Link Object that can be link to a URL, Email, Phone number, an internal Page or File.
gorriecoe/silverstripe-linkfield          1.1.2              Adds a Linkfield for gorriecoe/silverstripe-link
guzzlehttp/guzzle                         7.8.1              Guzzle is a PHP HTTP client library
guzzlehttp/promises                       2.0.2              Guzzle promises library
guzzlehttp/psr7                           2.6.2              PSR-7 message implementation that also provides common utility methods
heyday/silverstripe-colorpalette          2.1.0              A color palette picker for SilverStripe CMS
heyday/silverstripe-responsive-images     3.0.0              Configure and send a series of image size options to the client without loading any resources until a media query can be executed.
http-interop/http-factory-guzzle          1.2.0              An HTTP Factory using Guzzle PSR7
intervention/image                        2.7.2              Image handling and manipulation library with support for Laravel integration
jdorn/sql-formatter                       dev-master 7ef9b85 a PHP SQL highlighting library
jean85/pretty-package-versions            2.0.6              A library to get pretty versions strings of installed dependencies
jonom/focuspoint                          5.0.0              Smarter automatic image cropping for SilverStripe
jonom/silverstripe-betternavigator        6.1.0              Front-end utility menu for Silverstripe websites featuring administration and development tools
jonom/silverstripe-environment-awareness  2.0.4              Indicate current environment to Silverstripe users
lcobucci/clock                            3.2.0              Yet another clock abstraction
league/csv                                9.15.0             CSV data manipulation made easy in PHP
league/flysystem                          3.27.0             File storage abstraction for PHP
league/flysystem-local                    3.25.1             Local filesystem adapter for Flysystem.
league/mime-type-detection                1.15.0             Mime-type detection for Flysystem
lekoala/silverstripe-debugbar             dev-master e237ff7 DebugBar for SilverStripe CMS
m1/env                                    2.2.0              Env is a lightweight library bringing .env file parser compatibility to PHP. In short - it enables you to read .env files with PHP.
marcj/topsort                             2.0.0              High-Performance TopSort/Dependency resolving algorithm
masterminds/html5                         2.9.0              An HTML5 parser and serializer.
maximebf/debugbar                         v1.22.3            Debug bar in the browser for php application
ml/iri                                    1.1.4              IRI handling for PHP
ml/json-ld                                1.2.1              JSON-LD Processor for PHP
monolog/monolog                           3.6.0              Sends your logs to files, sockets, inboxes, databases and various web services
myclabs/deep-copy                         1.11.1             Create deep copies (clones) of your objects
nikic/php-parser                          v4.19.1            A PHP parser written in PHP
nyholm/psr7                               1.8.1              A fast PHP7 implementation of PSR-7
oscarotero/html-parser                    v0.1.8             Parse html strings to DOMDocument
paragonie/constant_time_encoding          v2.6.3             Constant-time Implementations of RFC 4648 Encoding (Base-64, Base-32, Base-16)
paragonie/csp-builder                     v2.9.0             Easily add and update Content-Security-Policy headers for your project
paragonie/random_compat                   v9.99.100          PHP 5.x polyfill for random_bytes() and random_int() from PHP 7
perftools/php-profiler                    1.1.2              PHP Profiling based on XHGui
phar-io/manifest                          2.0.4              Component for reading phar.io manifest information from a PHP Archive (PHAR)
phar-io/version                           3.2.1              Library for handling version information and constraints
php-http/client-common                    2.7.1              Common HTTP Client implementations and tools for HTTPlug
php-http/discovery                        1.19.4             Finds and installs PSR-7, PSR-17, PSR-18 and HTTPlug implementations
php-http/httplug                          2.4.0              HTTPlug, the HTTP client abstraction for PHP
php-http/message                          1.16.1             HTTP Message related tools
php-http/message-factory                  1.1.0              Factory interfaces for PSR-7 HTTP Message
php-http/promise                          1.3.1              Promise used for asynchronous HTTP requests
phpdocumentor/reflection-common           2.2.0              Common reflection classes used by phpdocumentor to reflect the code structure
phpdocumentor/reflection-docblock         5.4.0              With this component, a library can provide support for annotations via DocBlocks or otherwise retrieve information that is embedded in a DocBlock.
phpdocumentor/type-resolver               1.8.2              A PSR-5 based resolver of Class names, Types and Structural Element Names
phpspec/prophecy                          v1.19.0            Highly opinionated mocking framework for PHP 5.3+
phpstan/phpdoc-parser                     1.28.0             PHPDoc parser with support for nullable, intersection and generic types
phptek/sentry                             5.0.3              Sentry.io integration for SilverStripe. Binds Sentry.io to SilverStripe's error & exception handling subsystem.
phpunit/php-code-coverage                 9.2.31             Library that provides collection, processing, and rendering functionality for PHP code coverage information.
phpunit/php-file-iterator                 3.0.6              FilterIterator implementation that filters files based on a list of suffixes.
phpunit/php-invoker                       3.1.1              Invoke callables with a timeout
phpunit/php-text-template                 2.0.4              Simple template engine.
phpunit/php-timer                         5.0.3              Utility class for timing
phpunit/phpunit                           9.6.19             The PHP Unit Testing framework.
psr/cache                                 3.0.0              Common interface for caching libraries
psr/clock                                 1.0.0              Common interface for reading the clock.
psr/container                             2.0.2              Common Container Interface (PHP FIG PSR-11)
psr/event-dispatcher                      1.0.0              Standard interfaces for event handling.
psr/http-client                           1.0.3              Common interface for HTTP clients
psr/http-factory                          1.0.2              Common interfaces for PSR-7 HTTP message factories
psr/http-message                          1.1                Common interface for HTTP messages
psr/log                                   3.0.0              Common interface for logging libraries
psr/simple-cache                          3.0.0              Common interfaces for simple caching
ralouphie/getallheaders                   3.0.3              A polyfill for getallheaders.
roave/security-advisories                 dev-latest cab8d97 Prevents installation of composer packages with known security vulnerabilities: no API, simply require it
sebastian/cli-parser                      1.0.2              Library for parsing CLI options
sebastian/code-unit                       1.0.8              Collection of value objects that represent the PHP code units
sebastian/code-unit-reverse-lookup        2.0.3              Looks up which function or method a line of code belongs to
sebastian/comparator                      4.0.8              Provides the functionality to compare PHP values for equality
sebastian/complexity                      2.0.3              Library for calculating the complexity of PHP code units
sebastian/diff                            4.0.6              Diff implementation
sebastian/environment                     5.1.5              Provides functionality to handle HHVM/PHP environments
sebastian/exporter                        4.0.6              Provides the functionality to export PHP variables for visualization
sebastian/global-state                    5.0.7              Snapshotting of global state
sebastian/lines-of-code                   1.0.4              Library for counting the lines of code in PHP source code
sebastian/object-enumerator               4.0.4              Traverses array structures and object graphs to enumerate all referenced objects
sebastian/object-reflector                2.0.4              Allows reflection of object attributes, including inherited and non-public ones
sebastian/recursion-context               4.0.5              Provides functionality to recursively process PHP variables
sebastian/resource-operations             3.0.4              Provides a list of PHP built-in functions that operate on resources
sebastian/type                            3.2.1              Collection of value objects that represent the types of the PHP type system
sebastian/version                         3.0.2              Library that helps with managing the version number of Git-hosted PHP projects
sentry/sdk                                3.6.0              This is a metapackage shipping sentry/sentry with a recommended HTTP client.
sentry/sentry                             3.22.1             A PHP SDK for Sentry (http://sentry.io)
silverleague/ideannotator                 3.5.1              Generate PHP DocBlock annotations for DataObject and DataExtension databasefields and relation methods
silvershop/silverstripe-hasonefield       4.0.1              Edit a has_one relationship using a GridField, triggered by clicking a button.
silverstripe/admin                        2.2.1              SilverStripe admin interface
silverstripe/asset-admin                  2.2.0              Asset management for the SilverStripe CMS
silverstripe/assets                       2.2.0              SilverStripe Assets component
silverstripe/campaign-admin               2.2.0              SilverStripe campaign admin interface
silverstripe/closure                      3.99.99            A library that can be used to serialize closures (anonymous functions) and arbitrary objects.
silverstripe/cms                          5.2.0              The SilverStripe Content Management System
silverstripe/config                       2.1.0              SilverStripe configuration based on YAML and class statics
silverstripe/elemental-bannerblock        3.2.0              A banner block for the silverstripe-elemental module
silverstripe/elemental-fileblock          3.1.0              A file block for the silverstripe-elemental module
silverstripe/errorpage                    2.2.0              ErrorPage component for SilverStripe CMS
silverstripe/event-dispatcher             1.0.0              Publish and subscribe to events in Silverstripe CMS or your Silverstripe application
silverstripe/framework                    5.2.2              The SilverStripe framework
silverstripe/googlesitemaps               3.0.2              SilverStripe support for the Google Sitemaps XML, enabling Google and other search engines to see all urls on your site. This helps your SilverStripe website rank well i...
silverstripe/graphql                      5.2.0              GraphQL server for SilverStripe models and other data
silverstripe/login-forms                  5.2.0              A collection of templates for the CMS login screens
silverstripe/lumberjack                   3.1.0              A module to make managing pages in a GridField easy without losing any of the functionality that you're used to in the CMS.
silverstripe/mfa                          5.2.0              Enable multi-factor authentication with fallback codes
silverstripe/mimevalidator                3.1.0              Checks uploaded file content roughly matches a known MIME type for the file extension.
silverstripe/recipe-cms                   5.2.0              SilverStripe recipe for fully featured page and asset content editing
silverstripe/recipe-core                  5.2.0              SilverStripe framework-only core recipe
silverstripe/recipe-plugin                2.0.0              Helper plugin to install SilverStripe recipes
silverstripe/reports                      5.2.0              Reports module for SilverStripe CMS
silverstripe/session-manager              2.2.0              Allow users to manage and revoke access to multiple login sessions across devices.
silverstripe/sharedraftcontent            3.2.0              Share draft page content with non-CMS users
silverstripe/siteconfig                   5.2.0              Site wide settings administration.
silverstripe/spamprotection               4.2.0              Spam protection module for SilverStripe.
silverstripe/tagfield                     3.2.0              Tag field for SilverStripe
silverstripe/totp-authenticator           5.2.0              A TOTP authenticator for use with silverstripe/mfa
silverstripe/vendor-plugin                2.0.2              Allows vendor modules to expose directories to the webroot
silverstripe/versioned                    2.2.0              SilverStripe Versioned component
silverstripe/versioned-admin              2.2.0              SilverStripe versioned admin interface
silverstripe/webauthn-authenticator       5.2.0              A WebAuthn authenticator that plugs into the silverstripe/mfa module
sminnee/callbacklist                      0.1.1              PHP class that manages a list of callbacks
spomky-labs/cbor-php                      3.0.4              CBOR Encoder/Decoder for PHP
spomky-labs/otphp                         11.2.2             A PHP library for generating one time passwords according to RFC 4226 (HOTP Algorithm) and the RFC 6238 (TOTP Algorithm) and compatible with Google Authenticator
spomky-labs/pki-framework                 1.2.1              A PHP framework for managing Public Key Infrastructures. It comprises X.509 public key certificates, attribute certificates, certification requests and certification pat...
symbiote/silverstripe-gridfieldextensions 4.0.5              A collection of useful grid field components
symbiote/silverstripe-queuedjobs          5.1.0              A framework for defining and running background jobs in a queued manner
symfony/cache                             v6.4.6             Provides extended PSR-6, PSR-16 (and tags) implementations
symfony/cache-contracts                   v3.4.2             Generic abstractions related to caching
symfony/config                            v6.4.6             Helps you find, load, combine, autofill and validate configuration values of any kind
symfony/console                           v7.0.6             Eases the creation of beautiful and testable command line interfaces
symfony/deprecation-contracts             v3.4.0             A generic function and convention to trigger deprecation notices
symfony/dom-crawler                       v6.4.4             Eases DOM navigation for HTML and XML documents
symfony/event-dispatcher                  v6.4.3             Provides tools that allow your application components to communicate with each other by dispatching events and listening to them
symfony/event-dispatcher-contracts        v3.4.2             Generic abstractions related to dispatching event
symfony/filesystem                        v6.4.6             Provides basic utilities for the filesystem
symfony/finder                            v6.4.0             Finds files and directories via an intuitive fluent interface
symfony/http-client                       v7.0.6             Provides powerful methods to fetch HTTP resources synchronously or asynchronously
symfony/http-client-contracts             v3.4.2             Generic abstractions related to HTTP clients
symfony/mailer                            v6.4.6             Helps sending emails
symfony/mime                              v6.4.6             Allows manipulating MIME messages
symfony/options-resolver                  v7.0.0             Provides an improved replacement for the array_replace PHP function
symfony/polyfill-ctype                    v1.29.0            Symfony polyfill for ctype functions
symfony/polyfill-intl-grapheme            v1.29.0            Symfony polyfill for intl's grapheme_* functions
symfony/polyfill-intl-idn                 v1.29.0            Symfony polyfill for intl's idn_to_ascii and idn_to_utf8 functions
symfony/polyfill-intl-normalizer          v1.29.0            Symfony polyfill for intl's Normalizer class and related functions
symfony/polyfill-mbstring                 v1.29.0            Symfony polyfill for the Mbstring extension
symfony/polyfill-php72                    v1.29.0            Symfony polyfill backporting some PHP 7.2+ features to lower PHP versions
symfony/polyfill-php80                    v1.29.0            Symfony polyfill backporting some PHP 8.0+ features to lower PHP versions
symfony/polyfill-php81                    v1.29.0            Symfony polyfill backporting some PHP 8.1+ features to lower PHP versions
symfony/polyfill-php83                    v1.29.0            Symfony polyfill backporting some PHP 8.3+ features to lower PHP versions
symfony/polyfill-uuid                     v1.29.0            Symfony polyfill for uuid functions
symfony/process                           v7.0.4             Executes commands in sub-processes
symfony/service-contracts                 v3.4.2             Generic abstractions related to writing services
symfony/stopwatch                         v7.0.3             Provides a way to profile code
symfony/string                            v7.0.4             Provides an object-oriented API to strings and deals with bytes, UTF-8 code points and grapheme clusters in a unified way
symfony/translation                       v6.4.4             Provides tools to internationalize your application
symfony/translation-contracts             v3.4.2             Generic abstractions related to translation
symfony/uid                               v7.0.3             Provides an object-oriented API to generate and represent UIDs
symfony/validator                         v6.4.6             Provides tools to validate values
symfony/var-dumper                        v7.0.6             Provides mechanisms for walking through any arbitrary PHP variable
symfony/var-exporter                      v7.0.6             Allows exporting any serializable PHP data structure to plain PHP code
symfony/yaml                              v6.4.3             Loads and dumps YAML files
theseer/tokenizer                         1.2.3              A small library for converting tokenized PHP source code into XML and potentially other formats
tractorcow/classproxy                     1.0.0             
tractorcow/silverstripe-proxy-db          2.0.0             
ua-parser/uap-php                         v3.9.14            A multi-language port of Browserscope's user agent parser.
unclecheese/display-logic                 3.0.0              Allows assignment of conditions for display and hide of specific form fields based on client side behavior.
web-auth/cose-lib                         4.3.0              CBOR Object Signing and Encryption (COSE) For PHP
web-auth/metadata-service                 4.8.6              Metadata Service for FIDO2/Webauthn
web-auth/webauthn-lib                     4.8.6              FIDO2/Webauthn Support For PHP
webmozart/assert                          1.11.0             Assertions to validate method input/output with nice error messages.
webonyx/graphql-php                       v15.11.1           A PHP port of GraphQL reference implementation
xini commented 4 months ago

and is that error in the frontend or on upload?

Firesphere commented 4 months ago

The site breaks with anything involving an image, when this module is installed. Doesn't matter where. As per the GET above /?flush=all

xini commented 4 months ago

Is that file name actually Screenshot-2023-03-02-at-21-25-59-CSP-Can-I-use...-Support-tables-for-HTML5-CSS3-etc.png with the ... in the middle? If so, then SilverStripe\Core\Path::join() probably chokes on that.

madmatt commented 4 months ago

Yeah that looks like it's related to the ... Can you post the full backtrace perhaps so we can see where the call is coming from? Maybe we can work around it / it may not be needed. I'm surprised that wouldn't break on upload though if it did have dots in the filename, and if not we probably need a validation check for it in core because it could easily be a security risk.

Firesphere commented 4 months ago

Ehm, that is the full backtrace, before that is the kernel booting. Everything under the SSViewer call for the responsive images is not doing anything image-related, it's SSViewer parsing.

call_user_func_array(Array, Array)
ViewableData.php:556
SilverStripe\View\ViewableData->obj(ResponsiveSet1, , 1)
ViewableData.php:618
SilverStripe\View\ViewableData->XML_val(ResponsiveSet1, , 1)
SSViewer_Scope.php:342
SilverStripe\View\SSViewer_Scope->__call(XML_val, Array)
SSViewer_DataPresenter.php:327
SilverStripe\View\SSViewer_DataPresenter->__call(XML_val, Array)
.cachethemes.bootswatcher.templates.Dynamic.Elements.Features.Elements.ElementFeatures.ss:93
include(/tmp/silverstripe-cache-php8.2.18-var-www-html/firesphere/.cachethemes.bootswatcher.templates.Dynamic.Elements.Features.Elements.ElementFeatures.ss)
SSViewer.php:576
SilverStripe\View\SSViewer->includeGeneratedTemplate(/tmp/silverstripe-cache-php8.2.18-var-www-html/firesphere/.cachethemes.bootswatcher.templates.Dynamic.Elements.Features.Elements.ElementFeatures.ss, Dynamic\Elements\Features\Elements\ElementFeatures, , Array, )
SSViewer.php:648
SilverStripe\View\SSViewer->process(Dynamic\Elements\Features\Elements\ElementFeatures, , )
SSViewerProxy.php:53
LeKoala\DebugBar\Proxy\SSViewerProxy->process(Dynamic\Elements\Features\Elements\ElementFeatures, )
ViewableData.php:472
SilverStripe\View\ViewableData->renderWith(LeKoala\DebugBar\Proxy\SSViewerProxy)
BaseElement.php:605
DNADesign\Elemental\Models\BaseElement->forTemplate()
ViewableData.php:620
SilverStripe\View\ViewableData->XML_val(Element, , 1)
SSViewer_Scope.php:342
SilverStripe\View\SSViewer_Scope->__call(XML_val, Array)
SSViewer_DataPresenter.php:327
SilverStripe\View\SSViewer_DataPresenter->__call(XML_val, Array)
.cachethemes.bootswatcher.templates.DNADesign.Elemental.Layout.ElementHolder.ss:2
include(/tmp/silverstripe-cache-php8.2.18-var-www-html/firesphere/.cachethemes.bootswatcher.templates.DNADesign.Elemental.Layout.ElementHolder.ss)
SSViewer.php:576
SilverStripe\View\SSViewer->includeGeneratedTemplate(/tmp/silverstripe-cache-php8.2.18-var-www-html/firesphere/.cachethemes.bootswatcher.templates.DNADesign.Elemental.Layout.ElementHolder.ss, DNADesign\Elemental\Controllers\ElementController, , Array, )
SSViewer.php:648
SilverStripe\View\SSViewer->process(DNADesign\Elemental\Controllers\ElementController, , )
SSViewerProxy.php:53
LeKoala\DebugBar\Proxy\SSViewerProxy->process(DNADesign\Elemental\Controllers\ElementController, )
ViewableData.php:472
SilverStripe\View\ViewableData->renderWith(LeKoala\DebugBar\Proxy\SSViewerProxy)
ElementController.php:87
DNADesign\Elemental\Controllers\ElementController->forTemplate()
ViewableData.php:620
SilverStripe\View\ViewableData->XML_val(Me, , 1)
SSViewer_Scope.php:342
SilverStripe\View\SSViewer_Scope->__call(XML_val, Array)
SSViewer_DataPresenter.php:327
SilverStripe\View\SSViewer_DataPresenter->__call(XML_val, Array)
.cachethemes.bootswatcher.templates.DNADesign.Elemental.Models.ElementalArea.ss:10
include(/tmp/silverstripe-cache-php8.2.18-var-www-html/firesphere/.cachethemes.bootswatcher.templates.DNADesign.Elemental.Models.ElementalArea.ss)
SSViewer.php:576
SilverStripe\View\SSViewer->includeGeneratedTemplate(/tmp/silverstripe-cache-php8.2.18-var-www-html/firesphere/.cachethemes.bootswatcher.templates.DNADesign.Elemental.Models.ElementalArea.ss, DNADesign\Elemental\Models\ElementalArea, , Array, )
SSViewer.php:648
SilverStripe\View\SSViewer->process(DNADesign\Elemental\Models\ElementalArea, , )
SSViewerProxy.php:53
LeKoala\DebugBar\Proxy\SSViewerProxy->process(DNADesign\Elemental\Models\ElementalArea, )
ViewableData.php:472
SilverStripe\View\ViewableData->renderWith(LeKoala\DebugBar\Proxy\SSViewerProxy)
ElementalArea.php:98
DNADesign\Elemental\Models\ElementalArea->forTemplate()
ViewableData.php:620
SilverStripe\View\ViewableData->XML_val(ElementalArea, , 1)
SSViewer_Scope.php:342
SilverStripe\View\SSViewer_Scope->__call(XML_val, Array)
SSViewer_DataPresenter.php:327
SilverStripe\View\SSViewer_DataPresenter->__call(XML_val, Array)
.cachethemes.bootswatcher.templates.Page.ss:151
include(/tmp/silverstripe-cache-php8.2.18-var-www-html/firesphere/.cachethemes.bootswatcher.templates.Page.ss)
SSViewer.php:576
SilverStripe\View\SSViewer->includeGeneratedTemplate(/tmp/silverstripe-cache-php8.2.18-var-www-html/firesphere/.cachethemes.bootswatcher.templates.Page.ss, PageController, , Array, )
SSViewer.php:648
SilverStripe\View\SSViewer->process(PageController, , )
SSViewerProxy.php:53
LeKoala\DebugBar\Proxy\SSViewerProxy->process(PageController)
Controller.php:290
SilverStripe\Control\Controller->handleAction(SilverStripe\Control\HTTPRequest, index)
RequestHandler.php:200
SilverStripe\Control\RequestHandler->handleRequest(SilverStripe\Control\HTTPRequest)
Controller.php:200
SilverStripe\Control\Controller->handleRequest(SilverStripe\Control\HTTPRequest)
ContentController.php:219
SilverStripe\CMS\Controllers\ContentController->handleRequest(SilverStripe\Control\HTTPRequest)
ModelAsController.php:91
SilverStripe\CMS\Controllers\ModelAsController->handleRequest(SilverStripe\Control\HTTPRequest)
RootURLController.php:102
SilverStripe\CMS\Controllers\RootURLController->handleRequest(SilverStripe\Control\HTTPRequest)
Director.php:348
SilverStripe\Control\Director->SilverStripe\Control\{closure}(SilverStripe\Control\HTTPRequest)
VersionedHTTPMiddleware.php:41
SilverStripe\Versioned\VersionedHTTPMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
LoginSessionMiddleware.php:30
SilverStripe\SessionManager\Middleware\LoginSessionMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
ConfirmationMiddleware.php:254
SilverStripe\Control\Middleware\ConfirmationMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
ConfirmationMiddleware.php:254
SilverStripe\Control\Middleware\ConfirmationMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
PasswordExpirationMiddleware.php:84
SilverStripe\Security\PasswordExpirationMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
BasicAuthMiddleware.php:68
SilverStripe\Security\BasicAuthMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
AuthenticationMiddleware.php:61
SilverStripe\Security\AuthenticationMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
ExecMetricMiddleware.php:20
SilverStripe\Control\Middleware\ExecMetricMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
CanonicalURLMiddleware.php:245
SilverStripe\Control\Middleware\CanonicalURLMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
HTTPCacheControlMiddleware.php:39
SilverStripe\Control\Middleware\HTTPCacheControlMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
ChangeDetectionMiddleware.php:28
SilverStripe\Control\Middleware\ChangeDetectionMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
FlushMiddleware.php:30
SilverStripe\Control\Middleware\FlushMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
SessionMiddleware.php:20
SilverStripe\Control\Middleware\SessionMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
AllowedHostsMiddleware.php:60
SilverStripe\Control\Middleware\AllowedHostsMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
TrustedProxyMiddleware.php:176
SilverStripe\Control\Middleware\TrustedProxyMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
DebugBarMiddleware.php:17
LeKoala\DebugBar\Middleware\DebugBarMiddleware->process(SilverStripe\Control\HTTPRequest, Closure)
HTTPMiddlewareAware.php:62
SilverStripe\Control\Director->SilverStripe\Control\Middleware\{closure}(SilverStripe\Control\HTTPRequest)
HTTPMiddlewareAware.php:65
SilverStripe\Control\Director->callMiddleware(SilverStripe\Control\HTTPRequest, Closure)
Director.php:357
SilverStripe\Control\Director->handleRequest(SilverStripe\Control\HTTPRequest)
HTTPApplication.php:114
SilverStripe\Control\HTTPApplication::SilverStripe\Control\{closure}(SilverStripe\Control\HTTPRequest)
call_user_func(Closure, SilverStripe\Control\HTTPRequest)
HTTPApplication.php:137
SilverStripe\Control\HTTPApplication->SilverStripe\Control\{closure}(SilverStripe\Control\HTTPRequest)
HTTPMiddlewareAware.php:65
SilverStripe\Control\HTTPApplication->callMiddleware(SilverStripe\Control\HTTPRequest, Closure)
HTTPApplication.php:130
SilverStripe\Control\HTTPApplication->execute(SilverStripe\Control\HTTPRequest, Closure, )
HTTPApplication.php:113
SilverStripe\Control\HTTPApplication->handle(SilverStripe\Control\HTTPRequest)
index.php:29

More relevant though, is that the three dots don't break the framework, unless the responsive images is installed. And it works/worked fine on 5.1... I doubt dots are a potential breakage in the core, as long as the filename isn't ../../../, it should be okay to use dots :)

xini commented 4 months ago

My findings:

Can anyone confirm or debunk these findings please?

Firesphere commented 4 months ago

I can confirm that it happens only when this module is installed, andnot when it isn't.

xini commented 4 months ago

I have tested this on a bare SS 5.2 install (recipe-cms). The error happens when you do something like $Image.Fill(200,200) with an image with .. in the filename. And uploading it through an UploadField also triggers the error.

madmatt commented 4 months ago

Ehm, that is the full backtrace, before that is the kernel booting. Everything under the SSViewer call for the responsive images is not doing anything image-related, it's SSViewer parsing.

Oh sorry, my fault - I blame Mac OSX not showing scrollbars until you start scrolling. I literally just didn't scroll down your stacktrace, cos for me it's perfectly sized to be just the code snippet, and not the function call stack, so thought you'd only pulled out the code snippet 😂 My bad!

Firesphere commented 4 months ago

I found out that the problem being "solved" when uninstalling this module, is due to JonoM/silverstripe-focuspoint. For some reason, this module picking up the image first, prevents the problem from re-appearing. This module tries to read the image again before or after that, I'm not exactly sure, but that causes it to re-appear.

But yeah, it's a framework bug