public function SaveUploadFormTest::testHandleDangerousFile in Drupal 9

Same name and namespace in other branches

1. 8 core/modules/file/tests/src/Functional/SaveUploadFormTest.php \Drupal\Tests\file\Functional\SaveUploadFormTest::testHandleDangerousFile()

Tests dangerous file handling.

File

core/modules/file/tests/src/Functional/SaveUploadFormTest.php, line 230

Class

SaveUploadFormTest

Tests the _file_save_upload_from_form() function.

Namespace

Drupal\Tests\file\Functional

Code

public function testHandleDangerousFile() {
  $config = $this
    ->config('system.file');

  /** @var \Drupal\Core\File\FileSystemInterface $file_system */
  $file_system = \Drupal::service('file_system');

  // Allow the .php extension and make sure it gets renamed to .txt for
  // safety. Also check to make sure its MIME type was changed.
  $edit = [
    'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
    'files[file_test_upload][]' => $file_system
      ->realpath($this->phpfile->uri),
    'is_image_file' => FALSE,
    'extensions' => 'php txt',
  ];
  $this
    ->drupalGet('file-test/save_upload_from_form_test');
  $this
    ->submitForm($edit, 'Submit');
  $this
    ->assertSession()
    ->statusCodeEquals(200);
  $this
    ->assertSession()
    ->responseContains('For security reasons, your upload has been renamed to <em class="placeholder">' . $this->phpfile->filename . '_.txt' . '</em>');
  $this
    ->assertSession()
    ->pageTextContains('File MIME type is text/plain.');
  $this
    ->assertSession()
    ->pageTextContains("You WIN!");

  // Check that the correct hooks were called.
  $this
    ->assertFileHooksCalled([
    'validate',
    'insert',
  ]);

  // Ensure dangerous files are not renamed when insecure uploads is TRUE.
  // Turn on insecure uploads.
  $config
    ->set('allow_insecure_uploads', 1)
    ->save();

  // Reset the hook counters.
  file_test_reset();
  $this
    ->drupalGet('file-test/save_upload_from_form_test');
  $this
    ->submitForm($edit, 'Submit');
  $this
    ->assertSession()
    ->statusCodeEquals(200);
  $this
    ->assertSession()
    ->pageTextNotContains('For security reasons, your upload has been renamed');
  $this
    ->assertSession()
    ->pageTextContains("File name is {$this->phpfile->filename}");
  $this
    ->assertSession()
    ->pageTextContains("You WIN!");

  // Check that the correct hooks were called.
  $this
    ->assertFileHooksCalled([
    'validate',
    'insert',
  ]);

  // Turn off insecure uploads.
  $config
    ->set('allow_insecure_uploads', 0)
    ->save();

  // Reset the hook counters.
  file_test_reset();
  $edit = [
    'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
    'files[file_test_upload]' => \Drupal::service('file_system')
      ->realpath($this->phpfile->uri),
    'is_image_file' => FALSE,
    'extensions' => 'php',
  ];
  $this
    ->drupalGet('file-test/upload');
  $this
    ->submitForm($edit, 'Submit');
  $this
    ->assertSession()
    ->statusCodeEquals(200);
  $this
    ->assertSession()
    ->pageTextContains('For security reasons, your upload has been rejected.');
  $this
    ->assertSession()
    ->pageTextContains('Epic upload FAIL!');

  // Check that the correct hooks were called.
  $this
    ->assertFileHooksCalled([
    'validate',
  ]);
}