public function SaveUploadTest::testHandleExtension in Drupal 10

Same name and namespace in other branches

1. 8 core/modules/file/tests/src/Functional/SaveUploadTest.php \Drupal\Tests\file\Functional\SaveUploadTest::testHandleExtension()
2. 9 core/modules/file/tests/src/Functional/SaveUploadTest.php \Drupal\Tests\file\Functional\SaveUploadTest::testHandleExtension()

Tests extension handling.

File

core/modules/file/tests/src/Functional/SaveUploadTest.php, line 195

Class

SaveUploadTest

Tests the file_save_upload() function.

Namespace

Drupal\Tests\file\Functional

Code

public function testHandleExtension() {

  // The file being tested is a .gif which is in the default safe list
  // of extensions to allow when the extension validator isn't used. This is
  // implicitly tested at the testNormal() test. Here we tell
  // file_save_upload() to only allow ".foo".
  $extensions = 'foo';
  $edit = [
    'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
    'files[file_test_upload]' => \Drupal::service('file_system')
      ->realpath($this->image
      ->getFileUri()),
    'extensions' => $extensions,
  ];
  $this
    ->drupalGet('file-test/upload');
  $this
    ->submitForm($edit, 'Submit');
  $this
    ->assertSession()
    ->statusCodeEquals(200);
  $this
    ->assertSession()
    ->responseContains('Only files with the following extensions are allowed: <em class="placeholder">' . $extensions . '</em>');
  $this
    ->assertSession()
    ->pageTextContains("Epic upload FAIL!");

  // Check that the correct hooks were called.
  $this
    ->assertFileHooksCalled([
    'validate',
  ]);

  // Reset the hook counters.
  file_test_reset();
  $extensions = 'foo ' . $this->imageExtension;

  // Now tell file_save_upload() to allow the extension of our test image.
  $edit = [
    'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
    'files[file_test_upload]' => \Drupal::service('file_system')
      ->realpath($this->image
      ->getFileUri()),
    'extensions' => $extensions,
  ];
  $this
    ->drupalGet('file-test/upload');
  $this
    ->submitForm($edit, 'Submit');
  $this
    ->assertSession()
    ->statusCodeEquals(200);
  $this
    ->assertSession()
    ->pageTextNotContains("Only files with the following extensions are allowed:");
  $this
    ->assertSession()
    ->pageTextContains("You WIN!");

  // Check that the correct hooks were called.
  $this
    ->assertFileHooksCalled([
    'validate',
    'load',
    'update',
  ]);

  // Reset the hook counters.
  file_test_reset();

  // Now tell file_save_upload() to allow any extension.
  $edit = [
    'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
    'files[file_test_upload]' => \Drupal::service('file_system')
      ->realpath($this->image
      ->getFileUri()),
    'allow_all_extensions' => 'empty_array',
  ];
  $this
    ->drupalGet('file-test/upload');
  $this
    ->submitForm($edit, 'Submit');
  $this
    ->assertSession()
    ->statusCodeEquals(200);
  $this
    ->assertSession()
    ->pageTextNotContains("Only files with the following extensions are allowed:");
  $this
    ->assertSession()
    ->pageTextContains("You WIN!");

  // Check that the correct hooks were called.
  $this
    ->assertFileHooksCalled([
    'validate',
    'load',
    'update',
  ]);

  // Reset the hook counters.
  file_test_reset();

  // Now tell file_save_upload() to allow any extension and try and upload a
  // malicious file.
  $edit = [
    'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
    'files[file_test_upload]' => \Drupal::service('file_system')
      ->realpath($this->phpfile->uri),
    'allow_all_extensions' => 'empty_array',
    'is_image_file' => FALSE,
  ];
  $this
    ->drupalGet('file-test/upload');
  $this
    ->submitForm($edit, 'Submit');
  $this
    ->assertSession()
    ->statusCodeEquals(200);
  $this
    ->assertSession()
    ->responseContains('For security reasons, your upload has been renamed to <em class="placeholder">' . $this->phpfile->filename . '_.txt' . '</em>');
  $this
    ->assertSession()
    ->pageTextContains('File name is php-2.php_.txt.');
  $this
    ->assertSession()
    ->pageTextContains('File MIME type is text/plain.');
  $this
    ->assertSession()
    ->pageTextContains("You WIN!");

  // Check that the correct hooks were called.
  $this
    ->assertFileHooksCalled([
    'validate',
    'insert',
  ]);
}