[BUGFIX] Sanitize FlashMessage->createFromArray()

Resolves: #104249
Releases: main, 12.4
Change-Id: I2e56c967ab27ddc855261ff53f654d5916f3dce6
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/84999


Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>

Build/phpstan/phpstan-baseline.neon

@@ -830,11 +830,6 @@ parameters:
 			count: 1
 			path: ../../typo3/sysext/core/Classes/Mail/TransportFactory.php
 
-		-
-			message: "#^Method TYPO3\\\\CMS\\\\Core\\\\Messaging\\\\FlashMessage\\:\\:createFromArray\\(\\) should return static\\(TYPO3\\\\CMS\\\\Core\\\\Messaging\\\\FlashMessage\\) but returns object\\.$#"
-			count: 1
-			path: ../../typo3/sysext/core/Classes/Messaging/FlashMessage.php
-
 		-
 			message: "#^Call to an undefined method TYPO3\\\\CMS\\\\Core\\\\Cache\\\\Frontend\\\\FrontendInterface\\:\\:require\\(\\)\\.$#"
 			count: 1

typo3/sysext/core/Classes/Messaging/FlashMessage.php

@@ -56,15 +56,14 @@ class FlashMessage extends AbstractMessage
      * Factory method. Useful when creating flash messages from a jsonSerialize json_decode() call.
      *
      * @param array<string, string|int|bool> $data
-     * @return static
      */
     public static function createFromArray(array $data): self
     {
         return GeneralUtility::makeInstance(
             static::class,
-            (string)$data['message'],
+            (string)($data['message'] ?? ''),
             (string)($data['title'] ?? ''),
-            ContextualFeedbackSeverity::tryFrom($data['severity']) ?? ContextualFeedbackSeverity::OK,
+            ContextualFeedbackSeverity::tryFrom($data['severity'] ?? ContextualFeedbackSeverity::OK->value) ?? ContextualFeedbackSeverity::OK,
             (bool)($data['storeInSession'] ?? false)
         );
     }

typo3/sysext/core/Tests/Unit/Messaging/FlashMessageTest.php

@@ -36,4 +36,29 @@ final class FlashMessageTest extends UnitTestCase
         ];
         self::assertEquals($expected, $message->jsonSerialize());
     }
+
+    #[Test]
+    public function canCreateFromArray(): void
+    {
+        $message = FlashMessage::createFromArray([
+            'message' => 'my message',
+            'title' => 'my title',
+            'severity' => ContextualFeedbackSeverity::INFO->value,
+            'storeInSession' => true,
+        ]);
+        self::assertSame('my message', $message->getMessage());
+        self::assertSame('my title', $message->getTitle());
+        self::assertSame(ContextualFeedbackSeverity::INFO, $message->getSeverity());
+        self::assertTrue($message->isSessionMessage());
+    }
+
+    #[Test]
+    public function createFromArrayCreatesDefault(): void
+    {
+        $message = FlashMessage::createFromArray([]);
+        self::assertSame('', $message->getMessage());
+        self::assertSame('', $message->getTitle());
+        self::assertSame(ContextualFeedbackSeverity::OK, $message->getSeverity());
+        self::assertFalse($message->isSessionMessage());
+    }
 }