BUG: FlashMessages - current escaping of tags / collections leads to an exception

[iseries]

Is there an existing issue for this?

• [X] I have searched the existing issues

Current Behavior

It is possible to crash parts of the neos backend by just creating a collection or tag (management -> media) named %

Expected Behavior

Neos should not crash no matter what user input is made.

Steps To Reproduce

• navigate to the media section
• create a tag or collection named %

Environment

- Neos: 8.0, 8.1
- PHP: 8.1

Anything else?

notes

As Ferdinand Kuhl mentioned, there are some places where this happens. See e.g. the following line: https://github.com/neos/media-browser/blob/master/Classes/Controller/TagController.php#L78

This behavior could also occur with other methods, I have only tested it in the media library.

[iseries]

Note: The bug is present as long as the current session is active. When logout -> login it's working again.

[mhsdesign]

https://neos-project.slack.com/archives/C050C8FEK/p1664050267660589?thread_ts=1663958831.860119&cid=C050C8FEK

more infos...

[crydotsnake]

Can confirm the bug.

One idea would be to forbid the identifier %. I don't think anyone would name their tag or collection that way. It could also be that the error occurs with several identifiers except %.

[mhsdesign]

as proposed in slack - i think we should escape the user input % properly - that can be done via %%

[crydotsnake]

Solved with: #3942