Denial of Service in TYPO3 Bookmark Toolbar

@@ -17,6 +17,7 @@
 
 namespace TYPO3\CMS\Backend\Backend\Shortcut;
 
+use Psr\Log\LoggerInterface;
 use Symfony\Component\DependencyInjection\Attribute\Autoconfigure;
 use TYPO3\CMS\Backend\Module\ModuleProvider;
 use TYPO3\CMS\Backend\Routing\Router;
@@ -59,6 +60,7 @@ public function __construct(
         protected readonly ModuleProvider $moduleProvider,
         protected readonly Router $router,
         protected readonly UriBuilder $uriBuilder,
+        protected readonly LoggerInterface $logger,
     ) {
         $this->shortcutGroups = $this->initShortcutGroups();
         $this->shortcuts = $this->initShortcuts();
@@ -444,6 +446,13 @@ protected function initShortcuts(): array
                     } catch (FolderDoesNotExistException $e) {
                         // Folder does not longer exists. However, the shortcut
                         // is still displayed, allowing the user to remove it.
+                    } catch (\Throwable $e) {
+                        // Catch any other error or exception to avoid blocking this component
+                        $this->logger->error('Failed to resolve folder identifier "{folder}" in backend user shortcut: {message}', [
+                            'folder' => $folderIdentifier,
+                            'message' => $e->getMessage(),
+                        ]);
+                        continue;
                     }
                 }
             } else {

@@ -27,13 +27,16 @@
 use TYPO3\CMS\Core\Http\ServerRequest;
 use TYPO3\CMS\Core\Imaging\IconFactory;
 use TYPO3\CMS\Core\Localization\LanguageServiceFactory;
+use TYPO3\CMS\Core\Log\LogManager;
 use TYPO3\CMS\Core\Routing\RequestContextFactory;
 use TYPO3\TestingFramework\Core\Functional\FunctionalTestCase;
 
 final class ShortcutRepositoryTest extends FunctionalTestCase
 {
     protected ShortcutRepository $subject;
 
+    protected array $coreExtensionsToLoad = ['filelist'];
+
     protected function setUp(): void
     {
         parent::setUp();
@@ -46,13 +49,7 @@ protected function setUp(): void
         $requestContextFactory = $this->get(RequestContextFactory::class);
         $uriBuilder = $this->get(UriBuilder::class);
         $uriBuilder->setRequestContext($requestContextFactory->fromBackendRequest($request));
-        $this->subject = new ShortcutRepository(
-            $this->get(ConnectionPool::class),
-            $this->get(IconFactory::class),
-            $this->get(ModuleProvider::class),
-            $this->get(Router::class),
-            $this->get(UriBuilder::class),
-        );
+        $this->subject = $this->createShortcutRepository();
     }
 
     #[DataProvider('shortcutExistsTestDataProvider')]
@@ -186,4 +183,50 @@ public function getShortcutsByGroupTest(): void
             self::assertStringMatchesFormat($expected[$id]['href'], $shortcut['href']);
         }
     }
+
+    public static function invalidShortcutArgumentsAreIgnoredDataProvider(): \Generator
+    {
+        yield 'record_edit invalid JSON' => [
+            'record_edit',
+            '$INVALID/JSON$',
+        ];
+        yield 'record_edit invalid edit data' => [
+            'record_edit',
+            json_encode(['edit' => [9, 8, 7]]),
+        ];
+        yield 'record_edit incomplete edit data' => [
+            'record_edit',
+            json_encode(['edit' => ['invalid' => ['987' => 'edit']]]),
+        ];
+        yield 'media_management invalid path' => [
+            'media_management',
+            json_encode(['id' => '1:any/../../thing']),
+        ];
+        yield 'media_management non-existing path' => [
+            'media_management',
+            json_encode(['id' => '1:any/thing']),
+        ];
+    }
+
+    #[Test]
+    #[DataProvider('invalidShortcutArgumentsAreIgnoredDataProvider')]
+    public function invalidShortcutArgumentsAreIgnored($routIdentifier, string $arguments): void
+    {
+        $this->expectNotToPerformAssertions();
+        $this->subject->addShortcut($routIdentifier, $arguments, 'Test');
+        // create new instance to trigger initialization in constructor
+        $this->createShortcutRepository();
+    }
+
+    private function createShortcutRepository(): ShortcutRepository
+    {
+        return new ShortcutRepository(
+            $this->get(ConnectionPool::class),
+            $this->get(IconFactory::class),
+            $this->get(ModuleProvider::class),
+            $this->get(Router::class),
+            $this->get(UriBuilder::class),
+            $this->get(LogManager::class)->getLogger(ShortcutRepository::class),
+        );
+    }
 }