public function SaveUploadFormTest::testHandleDangerousFile in Drupal 10
Same name and namespace in other branches
- 8 core/modules/file/tests/src/Functional/SaveUploadFormTest.php \Drupal\Tests\file\Functional\SaveUploadFormTest::testHandleDangerousFile()
- 9 core/modules/file/tests/src/Functional/SaveUploadFormTest.php \Drupal\Tests\file\Functional\SaveUploadFormTest::testHandleDangerousFile()
Tests dangerous file handling.
File
- core/
modules/ file/ tests/ src/ Functional/ SaveUploadFormTest.php, line 230
Class
- SaveUploadFormTest
- Tests the _file_save_upload_from_form() function.
Namespace
Drupal\Tests\file\FunctionalCode
public function testHandleDangerousFile() {
$config = $this
->config('system.file');
/** @var \Drupal\Core\File\FileSystemInterface $file_system */
$file_system = \Drupal::service('file_system');
// Allow the .php extension and make sure it gets renamed to .txt for
// safety. Also check to make sure its MIME type was changed.
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload][]' => $file_system
->realpath($this->phpfile->uri),
'is_image_file' => FALSE,
'extensions' => 'php txt',
];
$this
->drupalGet('file-test/save_upload_from_form_test');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->responseContains('For security reasons, your upload has been renamed to <em class="placeholder">' . $this->phpfile->filename . '_.txt' . '</em>');
$this
->assertSession()
->pageTextContains('File MIME type is text/plain.');
$this
->assertSession()
->pageTextContains("You WIN!");
// Check that the correct hooks were called.
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
// Ensure dangerous files are not renamed when insecure uploads is TRUE.
// Turn on insecure uploads.
$config
->set('allow_insecure_uploads', 1)
->save();
// Reset the hook counters.
file_test_reset();
$this
->drupalGet('file-test/save_upload_from_form_test');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextNotContains('For security reasons, your upload has been renamed');
$this
->assertSession()
->pageTextContains("File name is {$this->phpfile->filename}");
$this
->assertSession()
->pageTextContains("You WIN!");
// Check that the correct hooks were called.
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
// Turn off insecure uploads.
$config
->set('allow_insecure_uploads', 0)
->save();
// Reset the hook counters.
file_test_reset();
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->phpfile->uri),
'is_image_file' => FALSE,
'extensions' => 'php',
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains('For security reasons, your upload has been rejected.');
$this
->assertSession()
->pageTextContains('Epic upload FAIL!');
// Check that the correct hooks were called.
$this
->assertFileHooksCalled([
'validate',
]);
}