function SaveUploadFormTest::testHandleDangerousFile

Tests dangerous file handling.

File

core/modules/file/tests/src/Functional/SaveUploadFormTest.php, line 233

Class

SaveUploadFormTest

Tests the <a href="/api/drupal/core%21modules%21file%21file.module/function/_file_save_upload_from_form/11.x" title="Saves form file uploads." class="local">_file_save_upload_from_form</a>() function.

Namespace

Code

public function testHandleDangerousFile() : void {
    $config = $this->config('system.file');
    
    /** @var \Drupal\Core\File\FileSystemInterface $file_system */
    $file_system = \Drupal::service('file_system');
    // Allow the .php extension and make sure it gets renamed to .txt for
    // safety. Also check to make sure its MIME type was changed.
    $edit = [
        'file_test_replace' => FileExists::Replace->name,
        'files[file_test_upload][]' => $file_system->realpath($this->phpFile->uri),
        'is_image_file' => FALSE,
        'extensions' => 'php txt',
    ];
    $this->drupalGet('file-test/save_upload_from_form_test');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->responseContains('For security reasons, your upload has been renamed to <em class="placeholder">' . $this->phpFile->filename . '_.txt' . '</em>');
    $this->assertSession()
        ->pageTextContains('File MIME type is text/plain.');
    $this->assertSession()
        ->pageTextContains("You WIN!");
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
        'insert',
    ]);
    // Ensure dangerous files are not renamed when insecure uploads is TRUE.
    // Turn on insecure uploads.
    $config->set('allow_insecure_uploads', 1)
        ->save();
    // Reset the hook counters.
    file_test_reset();
    $this->drupalGet('file-test/save_upload_from_form_test');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->pageTextNotContains('For security reasons, your upload has been renamed');
    $this->assertSession()
        ->pageTextContains("File name is {$this->phpFile->filename}");
    $this->assertSession()
        ->pageTextContains("You WIN!");
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
        'insert',
    ]);
    // Turn off insecure uploads.
    $config->set('allow_insecure_uploads', 0)
        ->save();
    // Reset the hook counters.
    file_test_reset();
    $edit = [
        'file_test_replace' => FileExists::Replace->name,
        'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->phpFile->uri),
        'is_image_file' => FALSE,
        'extensions' => 'php',
    ];
    $this->drupalGet('file-test/upload');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->pageTextContains('For security reasons, your upload has been rejected.');
    $this->assertSession()
        ->pageTextContains('Epic upload FAIL!');
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
    ]);
}