public function SaveUploadTest::testHandleDangerousFile in Drupal 8
Same name and namespace in other branches
- 9 core/modules/file/tests/src/Functional/SaveUploadTest.php \Drupal\Tests\file\Functional\SaveUploadTest::testHandleDangerousFile()
Test dangerous file handling.
File
- core/
modules/ file/ tests/ src/ Functional/ SaveUploadTest.php, line 256
Class
- SaveUploadTest
- Tests the file_save_upload() function.
Namespace
Drupal\Tests\file\FunctionalCode
public function testHandleDangerousFile() {
$config = $this
->config('system.file');
// Allow the .php extension and make sure it gets munged and given a .txt
// extension for safety. Also check to make sure its MIME type was changed.
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->phpfile->uri),
'is_image_file' => FALSE,
'extensions' => 'php',
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$message = t('For security reasons, your upload has been renamed to') . ' <em class="placeholder">' . $this->phpfile->filename . '_.txt' . '</em>';
$this
->assertRaw($message, 'Dangerous file was renamed.');
$this
->assertSession()
->pageTextContains('File name is php-2.php_.txt.');
$this
->assertRaw(t('File MIME type is text/plain.'), "Dangerous file's MIME type was changed.");
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
// Check that the correct hooks were called.
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
// Ensure dangerous files are not renamed when insecure uploads is TRUE.
// Turn on insecure uploads.
$config
->set('allow_insecure_uploads', 1)
->save();
// Reset the hook counters.
file_test_reset();
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertNoRaw(t('For security reasons, your upload has been renamed'), 'Found no security message.');
$this
->assertSession()
->pageTextContains('File name is php-2.php.');
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
// Check that the correct hooks were called.
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
// Reset the hook counters.
file_test_reset();
// Even with insecure uploads allowed, the .php file should not be uploaded
// if it is not explicitly included in the list of allowed extensions.
$edit['extensions'] = 'foo';
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$message = t('Only files with the following extensions are allowed:') . ' <em class="placeholder">' . $edit['extensions'] . '</em>';
$this
->assertRaw($message, 'Cannot upload a disallowed extension');
$this
->assertRaw(t('Epic upload FAIL!'), 'Found the failure message.');
// Check that the correct hooks were called.
$this
->assertFileHooksCalled([
'validate',
]);
// Reset the hook counters.
file_test_reset();
// Turn off insecure uploads, then try the same thing as above (ensure that
// the .php file is still rejected since it's not in the list of allowed
// extensions).
$config
->set('allow_insecure_uploads', 0)
->save();
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$message = t('Only files with the following extensions are allowed:') . ' <em class="placeholder">' . $edit['extensions'] . '</em>';
$this
->assertRaw($message, 'Cannot upload a disallowed extension');
$this
->assertRaw(t('Epic upload FAIL!'), 'Found the failure message.');
// Check that the correct hooks were called.
$this
->assertFileHooksCalled([
'validate',
]);
// Reset the hook counters.
file_test_reset();
}