Please notice global di.xml preference change for the Magento\Framework\Filter\VariableResolverInterface about magento-apsb22-48-security-patches HOT 5 CLOSED

This is a change between 2.4.3 and 2.4.4 and seems to be unrelated:

https://github.com/magento/magento2/blob/2.4.3/app/etc/di.xml#L1840
https://github.com/magento/magento2/blob/2.4.4/app/etc/di.xml#L1840

from magento-apsb22-48-security-patches.

Hi @razvanaldo ,

Thanks for notifying us! I'm currently looking at the 2.4.4-p1 and 2.4.4-p2 diffs and I can't see this change here.
Might only be introduced in the 2.4.5 patch I'll take a closer look at it tomorrow.

from magento-apsb22-48-security-patches.

Hi @razvanaldo ,

Just looked at it already and this seems to be an earlier fix in 2.4.4 and up, I think this is not related to the current security issues. But I'll keep this issue open just to be sure.

from magento-apsb22-48-security-patches.

@razvanaldo some background info about this change: https://zamoroka.medium.com/why-should-not-pass-objects-in-email-templates-41d2dbed5200

Summary: You shouldn't use objects in templates. While this is with security in mind as well (passing objects could also mean we could call object methods) it is unrelated to CVE-2022-35698 and CVE-2022-35689.

from magento-apsb22-48-security-patches.

@pmzandbergen I totally get it now, thanks for posting the article and for summarizing it
@stijnbernards thanks for having a look and for the work here

from magento-apsb22-48-security-patches.