[absumo]

Summary by Sourcery

Prevent authenticated meta URL generation from being used as an arbitrary callable vulnerability.

Bug Fixes:

• Prevent authenticated GenerateUrl requests from invoking arbitrary services or methods through unsafe reflection.
• Restrict meta URL callbacks to static getUrl and getUrlForCategory methods on valid module model classes.
• Reject malformed callback parameters instead of passing non-array values to URL generation.

Documentation:

• Clarify the supported meta URL callback classes and methods in form listener and repository documentation.

Tests:

• Add regression coverage for valid URL generation and rejection of arbitrary service and static method callbacks.

[sourcery-ai]

Reviewer's Guide

The PR hardens authenticated GenerateUrl AJAX handling against CWE-470 by replacing arbitrary service/method resolution with strict module-model and callback-method allowlists, while adding regression tests for both valid URL generation and the original exploit scenarios.

Sequence diagram for secured authenticated URL generation

sequenceDiagram
    participant Client as AuthenticatedClient
    participant Repository as MetaRepository
    participant Model as ModuleModel

    Client->>Repository: generateUrl(url, class, method, parameters)
    Repository->>Repository: guardCallback(class, method)
    alt Allowed module model and static callback
        Repository->>Model: call_user_func_array([class, method], actualParameters)
        Model-->>Repository: Generated URL
        Repository-->>Client: Generated URL
    else Invalid class or method
        Repository-->>Client: Exception
    end

Loading

File-Level Changes

Change	Details	Files
Restrict GenerateUrl callbacks to known module URL-generator methods instead of resolving arbitrary services or callable methods.	Allow only getUrl and getUrlForCategory. Require Backend or Frontend module Engine\Model class naming and existence. Require the selected method to exist and be static before invocation. Remove service-container lookup that enabled arbitrary service callbacks.	src/Common/Doctrine/Repository/MetaRepository.php
Add authenticated AJAX regression coverage for legitimate URL generation and blocked unsafe reflection paths.	Verify a valid Blog model getUrl callback still returns the expected slug. Verify the database service update exploit is rejected. Verify a non-URL Blog model method is rejected. Exercise CSRF-protected backend AJAX requests.	src/Backend/Core/Tests/Ajax/GenerateUrlTest.php

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 2 issues

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="src/Common/Doctrine/Repository/MetaRepository.php" line_range="20" />
<code_context>
+     * The only methods that may be invoked as a meta-url callback. Every module registers its URL
+     * generator through one of these (see Meta::setUrlCallback / AddMetaSubscriber).
+     */
+    private const ALLOWED_CALLBACK_METHODS = ['getUrl', 'getUrlForCategory'];
+
     public function __construct(ManagerRegistry $registry)
</code_context>
<issue_to_address>
**Meta forms fail to save**

When an application uses AddMetaSubscriber with a service ID or a public URL-generating method other than getUrl or getUrlForCategory, metaRepository::guardCallback() rejects the configured service ID or method because it falls outside the module-model namespace or method allowlist, so MetaType cannot generate the meta data during submission and the content is not saved.

Update guardCallback() to accept the callback classes and public URL-generating methods allowed by the AddMetaSubscriber contract instead of restricting them to the module-model namespace and hard-coded method list.

Also at `src/Common/Doctrine/Repository/MetaRepository.php:78-84`.
</issue_to_address>

### Comment 2
<location path="src/Backend/Core/Tests/Ajax/GenerateUrlTest.php" line_range="27" />
<code_context>
+                'className' => \Backend\Modules\Blog\Engine\Model::class,
+                'methodName' => 'getUrl',
+                'url' => 'Some Example Title',
+                'parameters' => '',
+            ]
+        );
</code_context>
<issue_to_address>
**URL callback regression tests fail**

When the regression tests run with their empty `parameters` values, `GenerateUrl` unserializes each empty `parameters` string to `false`, then passes it to `MetaRepository::generateUrl()` whose parameter requires an array; the valid-callback test receives an error instead of HTTP 200, while the rejection tests pass for that type error without exercising the callback guard.

Pass `serialize([])` in these tests, or normalize a failed `unserialize()` result to an empty array before calling `generateUrl()`.

Also at `src/Backend/Core/Tests/Ajax/GenerateUrlTest.php:42`, `src/Backend/Core/Tests/Ajax/GenerateUrlTest.php:50`.
</issue_to_address>

Sourcery assessment

Approval pending. 2 findings to address first.

Blocking findings: src/Common/Doctrine/Repository/MetaRepository.php:20, src/Backend/Core/Tests/Ajax/GenerateUrlTest.php:27

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook