[BUGFIX] Type check extbase parameter for array

If an argument on a plugin namespace is not an array,
Extbase failed hard with an type error exception.

Resolves: #91040
Releases: master, 10.4, 9.5
Change-Id: Ib613081aeb99232f1254a431fec57f15bb88b1c0
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/68936
Tested-by: core-ci <typo3@b13.com>
Tested-by: Benni Mack <benni@typo3.org>
Tested-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: Oliver Klee <typo3-coding@oliverklee.de>
Reviewed-by: Benni Mack <benni@typo3.org>
Reviewed-by: Oliver Bartsch <bo@cedev.de>

typo3/sysext/extbase/Classes/Mvc/Web/RequestBuilder.php

@@ -191,12 +191,13 @@ public function build()
         if ($typo3Request instanceof ServerRequestInterface) {
             $queryArguments = $typo3Request->getAttribute('routing');
             if ($queryArguments instanceof PageArguments) {
-                $getParameters = $queryArguments->get($pluginNamespace) ?? [];
+                $parameters = $queryArguments->get($pluginNamespace) ?? [];
             } else {
-                $getParameters = $typo3Request->getQueryParams()[$pluginNamespace] ?? [];
+                $parameters = $typo3Request->getQueryParams()[$pluginNamespace] ?? [];
             }
             $bodyParameters = $typo3Request->getParsedBody()[$pluginNamespace] ?? [];
-            $parameters = $getParameters;
+            $parameters = is_array($parameters) ? $parameters : [];
+            $bodyParameters = is_array($bodyParameters) ? $bodyParameters : [];
             ArrayUtility::mergeRecursiveWithOverrule($parameters, $bodyParameters);
         } else {
             $parameters = GeneralUtility::_GPmerged($pluginNamespace);

typo3/sysext/extbase/Tests/Functional/Mvc/Web/RequestBuilderTest.php

@@ -22,6 +22,7 @@
 use TYPO3\CMS\Core\Http\Uri;
 use TYPO3\CMS\Core\Routing\PageArguments;
 use TYPO3\CMS\Core\Utility\GeneralUtility;
+use TYPO3\CMS\Extbase\Configuration\ConfigurationManager;
 use TYPO3\CMS\Extbase\Configuration\ConfigurationManagerInterface;
 use TYPO3\CMS\Extbase\Mvc\Exception;
 use TYPO3\CMS\Extbase\Mvc\Exception\InvalidActionNameException;
@@ -720,4 +721,42 @@ public function resolveActionNameReturnsActionDefinedViaParsedBodyOfServerReques
         self::assertInstanceOf(RequestInterface::class, $request);
         self::assertSame('show', $request->getControllerActionName());
     }
+
+    /**
+     * @test
+     */
+    public function silentlyIgnoreInvalidParameter(): void
+    {
+        $pageArguments = new PageArguments(1, '0', ['tx_blog_example_blog' => 'not_an_array']);
+
+        $serverRequest = new ServerRequest(new Uri('https://example.com/'));
+        $serverRequest =  $serverRequest->withAttribute('routing', $pageArguments);
+        $GLOBALS['TYPO3_REQUEST'] = $serverRequest;
+
+        $extensionName = 'blog_example';
+        $pluginName = 'blog';
+
+        $GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['extbase']['extensions'][$extensionName]['modules'][$pluginName]['controllers'] = [
+            'ExtbaseTeam\BlogExample\Controller\BlogController' => [
+                'className' =>  'ExtbaseTeam\BlogExample\Controller\BlogController',
+                'alias' => 'BlogController',
+                'actions' => [
+                    'list', 'show'
+                ]
+            ]
+        ];
+
+        $configuration = [];
+        $configuration['extensionName'] = $extensionName;
+        $configuration['pluginName'] = $pluginName;
+
+        $configurationManager = $this->getContainer()->get(ConfigurationManager::class);
+        $configurationManager->setConfiguration($configuration);
+
+        $requestBuilder = $this->getContainer()->get(RequestBuilder::class);
+        $request = $requestBuilder->build();
+
+        self::assertInstanceOf(RequestInterface::class, $request);
+        self::assertSame('list', $request->getControllerActionName());
+    }
 }