Merge pull request #158 from magento-commerce/develop

MCLOUD-14023: Release cloud patches 1.1.11

Author: Vishalakshi-gv

composer.json

@@ -2,7 +2,7 @@
     "name": "magento/magento-cloud-patches",
     "description": "Provides critical fixes for Magento 2 Enterprise Edition",
     "type": "magento2-component",
-    "version": "1.1.10",
+    "version": "1.1.11",
     "license": "OSL-3.0",
     "repositories": {
         "repo.magento.com": {

patches.json

@@ -307,6 +307,9 @@
     },
     "Patch for CVE-2025-47110 - Improve-admin-cache-efficiency": {
       ">=2.4.4 <2.4.4-p14 || >=2.4.5 <2.4.5-p13 || >=2.4.6 <2.4.6-p11 || >=2.4.7 <2.4.7-p6 || 2.4.8": "MCLOUD-13753__Patch_for_CVE-2025-47110_improve-admin-cache-efficiency__2.4.x.patch"
+    },
+    "Patch for CVE-2025-54236 - WebAPI-improvement": {
+      ">=2.4.4 <2.4.4-p16 || >=2.4.5 <2.4.5-p15 || >=2.4.6 <2.4.6-p13 || >=2.4.7 <2.4.7-p8 || >=2.4.8 <2.4.8-p3": "MCLOUD-14016__Patch_for_CVE-2025-54236_webapi_improvement__2.4.x.patch"
     }
   },
   "magento/module-paypal": {

patches/MCLOUD-14016__Patch_for_CVE-2025-54236_webapi_improvement__2.4.x.patch

@@ -0,0 +1,18 @@
+diff --git a/vendor/magento/framework/Webapi/ServiceInputProcessor.php b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
+index ba58dc2bc7acf..06919af36d2eb 100644
+--- a/vendor/magento/framework/Webapi/ServiceInputProcessor.php
++++ b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
+@@ -246,6 +246,13 @@ private function getConstructorData(string $className, array $data): array
+             if (isset($data[$parameter->getName()])) {
+                 $parameterType = $this->typeProcessor->getParamType($parameter);
+ 
++                // Allow only simple types or Api Data Objects
++                if (!($this->typeProcessor->isTypeSimple($parameterType)
++                    || preg_match('~\\\\?\w+\\\\\w+\\\\Api\\\\Data\\\\~', $parameterType) === 1
++                )) {
++                    continue;
++                }
++
+                 try {
+                     $res[$parameter->getName()] = $this->convertValue($data[$parameter->getName()], $parameterType);
+                 } catch (\ReflectionException $e) {