public function SaveUploadTest::testHandleFileMunge in Drupal 9

Same name and namespace in other branches

1. 8 core/modules/file/tests/src/Functional/SaveUploadTest.php \Drupal\Tests\file\Functional\SaveUploadTest::testHandleFileMunge()

Tests file munge handling.

File

core/modules/file/tests/src/Functional/SaveUploadTest.php, line 428

Class

SaveUploadTest

Tests the file_save_upload() function.

Namespace

Drupal\Tests\file\Functional

Code

public function testHandleFileMunge() {

  // Ensure insecure uploads are disabled for this test.
  $this
    ->config('system.file')
    ->set('allow_insecure_uploads', 0)
    ->save();
  $original_image_uri = $this->image
    ->getFileUri();
  $this->image = file_move($this->image, $original_image_uri . '.foo.' . $this->imageExtension);

  // Reset the hook counters to get rid of the 'move' we just called.
  file_test_reset();
  $extensions = $this->imageExtension;
  $edit = [
    'files[file_test_upload]' => \Drupal::service('file_system')
      ->realpath($this->image
      ->getFileUri()),
    'extensions' => $extensions,
  ];
  $munged_filename = $this->image
    ->getFilename();
  $munged_filename = substr($munged_filename, 0, strrpos($munged_filename, '.'));
  $munged_filename .= '_.' . $this->imageExtension;
  $this
    ->drupalGet('file-test/upload');
  $this
    ->submitForm($edit, 'Submit');
  $this
    ->assertSession()
    ->statusCodeEquals(200);
  $this
    ->assertSession()
    ->pageTextContains('For security reasons, your upload has been renamed');
  $this
    ->assertSession()
    ->pageTextContains("File name is {$munged_filename}");
  $this
    ->assertSession()
    ->pageTextContains("You WIN!");

  // Check that the correct hooks were called.
  $this
    ->assertFileHooksCalled([
    'validate',
    'insert',
  ]);

  // Reset the hook counters.
  file_test_reset();

  // Ensure we don't munge the .foo extension if it is in the list of allowed
  // extensions.
  $extensions = 'foo ' . $this->imageExtension;
  $edit = [
    'files[file_test_upload]' => \Drupal::service('file_system')
      ->realpath($this->image
      ->getFileUri()),
    'extensions' => $extensions,
  ];
  $this
    ->drupalGet('file-test/upload');
  $this
    ->submitForm($edit, 'Submit');
  $this
    ->assertSession()
    ->statusCodeEquals(200);
  $this
    ->assertSession()
    ->pageTextNotContains('For security reasons, your upload has been renamed');
  $this
    ->assertSession()
    ->pageTextContains("File name is {$this->image->getFilename()}");
  $this
    ->assertSession()
    ->pageTextContains("You WIN!");

  // Check that the correct hooks were called.
  $this
    ->assertFileHooksCalled([
    'validate',
    'insert',
  ]);

  // Ensure we don't munge files if we're allowing any extension.
  $this->image = file_move($this->image, $original_image_uri . '.foo.txt.' . $this->imageExtension);

  // Reset the hook counters.
  file_test_reset();
  $edit = [
    'files[file_test_upload]' => \Drupal::service('file_system')
      ->realpath($this->image
      ->getFileUri()),
    'allow_all_extensions' => 'empty_array',
  ];
  $this
    ->drupalGet('file-test/upload');
  $this
    ->submitForm($edit, 'Submit');
  $this
    ->assertSession()
    ->statusCodeEquals(200);
  $this
    ->assertSession()
    ->pageTextNotContains('For security reasons, your upload has been renamed');
  $this
    ->assertSession()
    ->pageTextContains("File name is {$this->image->getFilename()}");
  $this
    ->assertSession()
    ->pageTextContains("You WIN!");

  // Check that the correct hooks were called.
  $this
    ->assertFileHooksCalled([
    'validate',
    'insert',
  ]);

  // Test that a dangerous extension such as .php is munged even if it is in
  // the list of allowed extensions.
  $this->image = file_move($this->image, $original_image_uri . '.php.' . $this->imageExtension);

  // Reset the hook counters.
  file_test_reset();
  $extensions = 'php ' . $this->imageExtension;
  $edit = [
    'files[file_test_upload]' => \Drupal::service('file_system')
      ->realpath($this->image
      ->getFileUri()),
    'extensions' => $extensions,
  ];
  $this
    ->drupalGet('file-test/upload');
  $this
    ->submitForm($edit, 'Submit');
  $this
    ->assertSession()
    ->statusCodeEquals(200);
  $this
    ->assertSession()
    ->pageTextContains('For security reasons, your upload has been renamed');
  $this
    ->assertSession()
    ->pageTextContains("File name is image-test.png_.php_.png");
  $this
    ->assertSession()
    ->pageTextContains("You WIN!");

  // Check that the correct hooks were called.
  $this
    ->assertFileHooksCalled([
    'validate',
    'insert',
  ]);

  // Reset the hook counters.
  file_test_reset();

  // Dangerous extensions are munged even when all extensions are allowed.
  $edit = [
    'files[file_test_upload]' => \Drupal::service('file_system')
      ->realpath($this->image
      ->getFileUri()),
    'allow_all_extensions' => 'empty_array',
  ];
  $this
    ->drupalGet('file-test/upload');
  $this
    ->submitForm($edit, 'Submit');
  $this
    ->assertSession()
    ->statusCodeEquals(200);
  $this
    ->assertSession()
    ->pageTextContains('For security reasons, your upload has been renamed');
  $this
    ->assertSession()
    ->pageTextContains("File name is image-test.png_.php__0.png");
  $this
    ->assertSession()
    ->pageTextContains("You WIN!");

  // Check that the correct hooks were called.
  $this
    ->assertFileHooksCalled([
    'validate',
    'insert',
  ]);

  // Dangerous extensions are munged if is renamed to end in .txt.
  $this->image = file_move($this->image, $original_image_uri . '.cgi.' . $this->imageExtension . '.txt');

  // Reset the hook counters.
  file_test_reset();

  // Dangerous extensions are munged even when all extensions are allowed.
  $edit = [
    'files[file_test_upload]' => \Drupal::service('file_system')
      ->realpath($this->image
      ->getFileUri()),
    'allow_all_extensions' => 'empty_array',
  ];
  $this
    ->drupalGet('file-test/upload');
  $this
    ->submitForm($edit, 'Submit');
  $this
    ->assertSession()
    ->statusCodeEquals(200);
  $this
    ->assertSession()
    ->pageTextContains('For security reasons, your upload has been renamed');
  $this
    ->assertSession()
    ->pageTextContains("File name is image-test.png_.cgi_.png_.txt");
  $this
    ->assertSession()
    ->pageTextContains("You WIN!");

  // Check that the correct hooks were called.
  $this
    ->assertFileHooksCalled([
    'validate',
    'insert',
  ]);

  // Reset the hook counters.
  file_test_reset();

  // Ensure that setting $validators['file_validate_extensions'] = ['']
  // rejects all files without munging or renaming.
  $edit = [
    'files[file_test_upload][]' => \Drupal::service('file_system')
      ->realpath($this->image
      ->getFileUri()),
    'allow_all_extensions' => 'empty_string',
  ];
  $this
    ->drupalGet('file-test/save_upload_from_form_test');
  $this
    ->submitForm($edit, 'Submit');
  $this
    ->assertSession()
    ->statusCodeEquals(200);
  $this
    ->assertSession()
    ->pageTextNotContains('For security reasons, your upload has been renamed');
  $this
    ->assertSession()
    ->pageTextContains("Epic upload FAIL!");

  // Check that the correct hooks were called.
  $this
    ->assertFileHooksCalled([
    'validate',
  ]);
}