Issue #2239009 by effulgentsia, dawehner: Remove public direct usage of the '_system_path' request attribute.

core/lib/Drupal/Core/Access/CsrfAccessCheck.php

@@ -51,6 +51,8 @@ class CsrfAccessCheck implements RoutingAccessInterface {
   public function access(Route $route, Request $request) {
     // If this is the controller request, check CSRF access as normal.
     if ($request->attributes->get('_controller_request')) {
+      // @todo Remove dependency on the internal _system_path attribute:
+      //   https://www.drupal.org/node/2293501.
       return $this->csrfToken->validate($request->query->get('token'), $request->attributes->get('_system_path')) ? static::ALLOW : static::KILL;
     }
 

core/lib/Drupal/Core/Controller/ExceptionController.php

@@ -142,6 +142,8 @@ class ExceptionController extends HtmlControllerBase implements ContainerAwareIn
    *   A response object.
    */
   public function on403Html(FlattenException $exception, Request $request) {
+    // @todo Remove dependency on the internal _system_path attribute:
+    //   https://www.drupal.org/node/2293523.
     $system_path = $request->attributes->get('_system_path');
     watchdog('access denied', $system_path, array(), WATCHDOG_WARNING);
 
@@ -200,6 +202,8 @@ class ExceptionController extends HtmlControllerBase implements ContainerAwareIn
       }
     }
 
+    // @todo Remove dependency on the internal _system_path attribute:
+    //   https://www.drupal.org/node/2293523.
     $system_path = $request->attributes->get('_system_path');
 
     $path = $this->container->get('path.alias_manager')->getPathByAlias(\Drupal::config('system.site')->get('page.404'));

core/lib/Drupal/Core/Form/FormSubmitter.php

@@ -205,6 +205,8 @@ class FormSubmitter implements FormSubmitterInterface {
         }
       }
       $request = $this->requestStack->getCurrentRequest();
+      // @todo Remove dependency on the internal _system_path attribute:
+      //   https://www.drupal.org/node/2293521.
       $url = $this->urlGenerator->generateFromPath($request->attributes->get('_system_path'), array(
         'query' => $request->query->all(),
         'absolute' => TRUE,

core/modules/system/src/Plugin/Condition/RequestPath.php

@@ -140,6 +140,8 @@ class RequestPath extends ConditionPluginBase implements ContainerFactoryPluginI
 
     $request = $this->requestStack->getCurrentRequest();
     // Compare the lowercase path alias (if any) and internal path.
+    // @todo Remove dependency on the internal _system_path attribute:
+    //   https://www.drupal.org/node/2293581.
     $path = $request->attributes->get('_system_path');
     $path_alias = Unicode::strtolower($this->aliasManager->getAliasByPath($path));
 

core/modules/user/src/EventSubscriber/MaintenanceModeSubscriber.php

@@ -28,6 +28,8 @@ class MaintenanceModeSubscriber implements EventSubscriberInterface {
     $user = \Drupal::currentUser();
     $request = $event->getRequest();
     $site_status = $request->attributes->get('_maintenance');
+    // @todo Remove dependency on the internal _system_path attribute:
+    //   https://www.drupal.org/node/2288911.
     $path = $request->attributes->get('_system_path');
     if ($site_status == CoreMaintenanceModeSubscriber::SITE_OFFLINE) {
       // If the site is offline, log out unprivileged users.

core/modules/views/src/Plugin/views/argument_default/Raw.php

@@ -89,6 +89,8 @@ class Raw extends ArgumentDefaultPluginBase {
   }
 
   public function getArgument() {
+    // @todo Remove dependency on the internal _system_path attribute:
+    //   https://www.drupal.org/node/2293581.
     $path = $this->view->getRequest()->attributes->get('_system_path');
     if ($this->options['use_alias']) {
       $path = $this->aliasManager->getAliasByPath($path);