• When calling the getValue($array, $parents) method, the process is as follows:

$ref prohibits references to $array.

First loop: $ref reference to $array['a'].

Second of the loop: $ref reference to $array['a']['b'].

Third of the loop: $ref reference to $array['a']['b']['c'].

The end result, $ref will be referenced to the value 42.

• After receiving $form value from func getValue. $form will become an argument for the Render function

• The definition of call_user_func

• The result when I use file exploit:

Mitigation

• Patch ** Drupal developers have published a patch, adding a RequestSanitizer class with a stripDangerousValues ​​method to remove all input elements of the array whose keys begin with “#”. This method cleans input in $_GET, $_POST, and $_COOKIES.

** Drupal 8.6.5 /core/lib/Drupal/Core/DrupalKernel.php /core/lib/Drupal/Core/Security/RequestSanitizer.php ** The stripDangerousValues ​​function verifies all the input parameters one by one, the first elements of the input array have a value starting with “#” and the values ​​not whitelisted are removed.