Problem/Motivation
Having read the docs of MenuLinkInterface::isCacheable():
/**
* Returns whether the rendered link can be cached.
*
* The plugin class may make some or all of the data used in the Url object
* and build array dynamic. For example, it could include the current user
* name in the title, the current time in the description, or a destination
* query string. In addition the route parameters may be dynamic so an access
* check should be performed for each user.
*
* @return bool
* TRUE if the link can be cached, FALSE otherwise.
*/
public function isCacheable();and comparing that to MenuLinkContent::isCacheable() (this is the plugin for the user-creatable menu link entities) implementation, which is the one inherited from MenuLinkBase::isCacheable(), looks like this:
public function isCacheable() {
return TRUE;
}This hardcoded TRUE is a lie, because user-created links could link to e.g.
/admin/appearance/enable?theme=stark{menu_link_content_data}). This menu link, will be processed by Drupal\Core\Access\RouteProcessorCsrf when rendered (an outbound route processor, see
Drupal\Core\RouteProcessor\OutboundRouteProcessorInterface) and will be "processed" into /admin/appearance/enable?token=DQ9PFhUK_qYrPQ97BG0tgK2LtAfzZeNJi5Iw4Ep73FE&theme=starkYet isCacheable() returns TRUE, which is a violation of the isCacheable() documentation.
#1805054: [PP-1] Cache localized, access filtered, URL resolved, (and rendered?) menu trees needs this to work correctly, otherwise render caching of menus is not possible.
Proposed resolution
Fix MenuLinkContent::isCacheable().
Remaining tasks
- Review.
Test coverage.- Get green.
User interface changes
None.
API changes
OutboundRouteProcessorInterface::processOutbound()no longer checks if it applies, it just performs the processing.- Whether the outbound route processor applies is done in a new
OutboundRouteProcessorInterface::applies()method, similar toAccessCheckInterface.