[BUGFIX] Prevent double flexform xml2array parsing

Check the pi_flexform value of the request attribute
'currentContentObject' to be of type string before parsing with
GU::xml2array().

Resolves: #105195
Releases: main, 12.4
Change-Id: I915deeb89c39b4b90342da582b05acc98a7b86fd
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86417


Tested-by: core-ci <typo3@b13.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Tested-by: Garvin Hicking <gh@faktor-e.de>
Reviewed-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Garvin Hicking <gh@faktor-e.de>

typo3/sysext/form/Classes/Controller/FormFrontendController.php

@@ -91,8 +91,11 @@ class FormFrontendController extends ActionController
      */
     protected function overrideByFlexFormSettings(array $formDefinition): array
     {
-        $flexFormData = GeneralUtility::xml2array($this->request->getAttribute('currentContentObject')?->data['pi_flexform'] ?? '');
-        if (!is_array($flexFormData)) {
+        $flexFormData = $this->request->getAttribute('currentContentObject')?->data['pi_flexform'] ?? [];
+        if (is_string($flexFormData) && $flexFormData !== '') {
+            $flexFormData = GeneralUtility::xml2array($flexFormData);
+        }
+        if (!is_array($flexFormData) || $flexFormData === []) {
             return $formDefinition;
         }
         if (isset($formDefinition['finishers'])) {