Merge pull request #158 from magento-commerce/develop

MCLOUD-14023: Release cloud patches 1.1.11

Author: Vishalakshi-gv

composer.json

@@ -2,7 +2,7 @@
  "name": "magento/magento-cloud-patches",
  "description": "Provides critical fixes for Magento 2 Enterprise Edition",
  "type": "magento2-component",
- "version": "1.1.10",
+ "version": "1.1.11",
  "license": "OSL-3.0",
  "repositories": {
  "repo.magento.com": {

patches.json

@@ -307,6 +307,9 @@
  },
  "Patch for CVE-2025-47110 - Improve-admin-cache-efficiency": {
  ">=2.4.4 <2.4.4-p14 || >=2.4.5 <2.4.5-p13 || >=2.4.6 <2.4.6-p11 || >=2.4.7 <2.4.7-p6 || 2.4.8": "MCLOUD-13753__Patch_for_CVE-2025-47110_improve-admin-cache-efficiency__2.4.x.patch"
+ },
+ "Patch for CVE-2025-54236 - WebAPI-improvement": {
+ ">=2.4.4 <2.4.4-p16 || >=2.4.5 <2.4.5-p15 || >=2.4.6 <2.4.6-p13 || >=2.4.7 <2.4.7-p8 || >=2.4.8 <2.4.8-p3": "MCLOUD-14016__Patch_for_CVE-2025-54236_webapi_improvement__2.4.x.patch"
  }
  },
  "magento/module-paypal": {

patches/MCLOUD-14016__Patch_for_CVE-2025-54236_webapi_improvement__2.4.x.patch

@@ -0,0 +1,18 @@
+diff --git a/vendor/magento/framework/Webapi/ServiceInputProcessor.php b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
+index ba58dc2bc7acf..06919af36d2eb 100644
+--- a/vendor/magento/framework/Webapi/ServiceInputProcessor.php
++++ b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
+@@ -246,6 +246,13 @@ private function getConstructorData(string $className, array $data): array
+ if (isset($data[$parameter->getName()])) {
+ $parameterType = $this->typeProcessor->getParamType($parameter);
+ 
++ // Allow only simple types or Api Data Objects
++ if (!($this->typeProcessor->isTypeSimple($parameterType)
++ || preg_match('~\\\\?\w+\\\\\w+\\\\Api\\\\Data\\\\~', $parameterType) === 1
++ )) {
++ continue;
++ }
++
+ try {
+ $res[$parameter->getName()] = $this->convertValue($data[$parameter->getName()], $parameterType);
+ } catch (\ReflectionException $e) {