[BUGFIX] Keep extbase attributes in OriginalRequest

When an Extbase action returns a ForwardResponse, the
extbase attributes of the originalRequest are overwritten,
because the resulting request object is cloned from the
current request which holds a reference to extbase
attributes.

This change ensures, that the extbase attributes
remain in their original state in the originalRequest
object.

Resolves #95095
Releases: master
Change-Id: I25d9c3451146ec06e13bc207e52dc76024892fd0
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/71133
Tested-by: core-ci <typo3@b13.com>
Tested-by: Nikita Hovratov <nikita.h@live.de>
Tested-by: Benjamin Franzke <bfr@qbus.de>
Reviewed-by: Nikita Hovratov <nikita.h@live.de>
Reviewed-by: Benjamin Franzke <bfr@qbus.de>

typo3/sysext/extbase/Classes/Mvc/Dispatcher.php

@@ -150,7 +150,9 @@ protected function resolveController(RequestInterface $request)
      */
     public static function buildRequestFromCurrentRequestAndForwardResponse(Request $currentRequest, ForwardResponse $forwardResponse): Request
     {
-        $request = clone $currentRequest;
+        $extbaseAttribute = clone $currentRequest->getAttribute('extbase');
+        $request = $currentRequest->withAttribute('extbase', $extbaseAttribute);
+
         // @deprecated since v11, will be removed in v12.
         $request->setDispatched(false);
         $request->setControllerActionName($forwardResponse->getActionName());

typo3/sysext/extbase/Tests/Functional/Mvc/Validation/ActionControllerValidationTest.php

@@ -182,6 +182,65 @@ public function validationResultsAreProvidedForTheSameObjectInDifferentArguments
         self::assertEquals('testFormAction', $response->getBody()->getContents());
     }
 
+    /**
+     * @test
+     */
+    public function argumentsOfOriginalRequestRemainOnValidationErrors(): void
+    {
+        $GLOBALS['LANG'] = $this->getContainer()->get(LanguageServiceFactory::class)->create('default');
+        $GLOBALS['TYPO3_CONF_VARS']['SYS']['encryptionKey'] = 'testkey';
+
+        $this->importDataSet('PACKAGE:typo3/testing-framework/Resources/Core/Functional/Fixtures/pages.xml');
+        $this->importDataSet(ORIGINAL_ROOT . 'typo3/sysext/extbase/Tests/Functional/Persistence/Fixtures/blogs.xml');
+        $this->importDataSet(ORIGINAL_ROOT . 'typo3/sysext/extbase/Tests/Functional/Persistence/Fixtures/posts.xml');
+
+        $response = new Response();
+        $request = new Request();
+
+        $request->setControllerActionName('testRelatedObject');
+        $request->setArgument('blog', ['__identity' => 1, 'description' => str_repeat('test', 40)]);
+        $request->setArgument(
+            'blogPost',
+            ['__identity' => 1, 'title' => '77', 'blog' => ['__identity' => 1, 'title' => str_repeat('test', 21)]]
+        );
+        $request->setArgument(
+            '__trustedProperties',
+            $this->generateTrustedPropertiesToken(
+                [
+                    'blog[__identity]',
+                    'blog[description]',
+                    'blogPost[__identity]',
+                    'blogPost[title]',
+                    'blogPost[blog][__identity]',
+                    'blogPost[blog][title]',
+                ]
+            )
+        );
+
+        $referrerRequest = [];
+        $referrerRequest['@action'] = 'testForm';
+        $request->setArgument(
+            '__referrer',
+            ['@request' => $this->getHashService()->appendHmac(json_encode($referrerRequest))]
+        );
+
+        $originalArguments = $request->getArguments();
+        while (!$request->isDispatched()) {
+            try {
+                $blogController = $this->getContainer()->get(BlogController::class);
+                $response = $blogController->processRequest($request);
+                if ($response instanceof ForwardResponse) {
+                    $request = Dispatcher::buildRequestFromCurrentRequestAndForwardResponse($request, $response);
+                    self::assertEquals($originalArguments, $request->getOriginalRequest()->getAttribute('extbase')->getArguments());
+                }
+            } catch (StopActionException $e) {
+            }
+        }
+
+        $response->getBody()->rewind();
+        self::assertEquals('testFormAction', $response->getBody()->getContents());
+    }
+
     /**
      * @param array $formFieldNames
      * @return string