Merge pull request #76 from magento-commerce/MCLOUD-10226

MCLOUD-10226: Fix regexp cache tag validation

Author: BaDos

patches.json

@@ -396,5 +396,10 @@
       ">=2.3.4-p2 <2.3.7-p3 || >=2.4.0 <2.4.3": "MDVA-43443__parser_token_new_fix__2.3.4-p2.patch",
       ">=2.4.3 <2.4.3-p2": "MDVA-43443__parser_token_new_fix__2.4.3.patch"
     }
+  },
+  "magento/framework": {
+    "Fix regexp cache tag validation": {
+      ">=103.0.6 <103.0.7": "MCLOUD-10226__fix_regexp_cache_tag_validation__2.4.6.patch"
+    }
   }
 }

patches/MCLOUD-10226__fix_regexp_cache_tag_validation__2.4.6.patch

@@ -0,0 +1,49 @@
+diff -Naur a/vendor/magento/framework/Cache/Core.php b/vendor/magento/framework/Cache/Core.php
+--- a/vendor/magento/framework/Cache/Core.php	2023-02-23 14:11:04
++++ b/vendor/magento/framework/Cache/Core.php	2023-04-14 11:54:58
+@@ -5,6 +5,10 @@ namespace Magento\Framework\Cache;
+  */
+ namespace Magento\Framework\Cache;
+
++use Magento\Framework\Cache\Backend\Redis;
++use Zend_Cache;
++use Zend_Cache_Exception;
++
+ class Core extends \Zend_Cache_Core
+ {
+     /**
+@@ -124,6 +128,34 @@ class Core extends \Zend_Cache_Core
+     {
+         $tags = $this->_tags($tags);
+         return parent::getIdsNotMatchingTags($tags);
++    }
++
++    /**
++     * Validate a cache id or a tag (security, reliable filenames, reserved prefixes...)
++     *
++     * Throw an exception if a problem is found
++     *
++     * @param  string $string Cache id or tag
++     * @throws Zend_Cache_Exception
++     * @return void
++     */
++    protected function _validateIdOrTag($string)
++    {
++        if ($this->_backend instanceof Redis) {
++            if (!is_string($string)) {
++                Zend_Cache::throwException('Invalid id or tag : must be a string');
++            }
++            if (substr($string, 0, 9) == 'internal-') {
++                Zend_Cache::throwException('"internal-*" ids or tags are reserved');
++            }
++            if (!preg_match('~^[a-zA-Z0-9_{}]+$~D', $string)) {
++                Zend_Cache::throwException("Invalid id or tag '$string' : must use only [a-zA-Z0-9_{}]");
++            }
++
++            return;
++        }
++
++        parent::_validateIdOrTag($string);
+     }
+
+     /**

src/Test/Functional/Acceptance/AcceptanceCest.php

@@ -49,7 +49,8 @@ public function testPatches(\CliTester $I, \Codeception\Example $data): void
     protected function patchesDataProvider(): array
     {
         return [
-            ['templateVersion' => '2.4.6', 'magentoVersion' => null],
+            ['templateVersion' => '2.4.6', 'magentoVersion' => '2.4.6'],
+            ['templateVersion' => '2.4.6', 'magentoVersion' => '2.4.6-p1'],
         ];
     }
 }