function SaveUploadTest::testHandleDangerousFile

Tests dangerous file handling.

File

core/modules/file/tests/src/Functional/SaveUploadTest.php, line 292

Class

SaveUploadTest

Tests the file_save_upload() function.

Namespace

Code

public function testHandleDangerousFile() : void {
  $config = $this->config('system.file');
  // Allow the .php extension and make sure it gets munged and given a .txt
  // extension for safety. Also check to make sure its MIME type was changed.
  $edit = [
    'file_test_replace' => FileExists::Replace->name,
    'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->phpFile->uri),
    'is_image_file' => FALSE,
    'extensions' => 'php txt',
  ];
  $this->drupalGet('file-test/upload');
  $this->submitForm($edit, 'Submit');
  $this->assertSession()
    ->statusCodeEquals(200);
  $this->assertSession()
    ->responseContains('For security reasons, your upload has been renamed to <em class="placeholder">' . $this->phpFile->filename . '_.txt' . '</em>');
  $this->assertSession()
    ->pageTextContains('File name is php-2.php_.txt.');
  $this->assertSession()
    ->pageTextContains('File MIME type is text/plain.');
  $this->assertSession()
    ->pageTextContains("You WIN!");
  // Check that the correct hooks were called.
  $this->assertFileHooksCalled([
    'validate',
    'insert',
  ]);
  // Ensure dangerous files are not renamed when insecure uploads is TRUE.
  // Turn on insecure uploads.
  $config->set('allow_insecure_uploads', 1)
    ->save();
  // Reset the hook counters.
  file_test_reset();
  $this->drupalGet('file-test/upload');
  $this->submitForm($edit, 'Submit');
  $this->assertSession()
    ->statusCodeEquals(200);
  $this->assertSession()
    ->pageTextNotContains('For security reasons, your upload has been renamed');
  $this->assertSession()
    ->pageTextContains('File name is php-2.php.');
  $this->assertSession()
    ->pageTextContains("You WIN!");
  // Check that the correct hooks were called.
  $this->assertFileHooksCalled([
    'validate',
    'insert',
  ]);
  // Reset the hook counters.
  file_test_reset();
  // Even with insecure uploads allowed, the .php file should not be uploaded
  // if it is not explicitly included in the list of allowed extensions.
  $edit['extensions'] = 'foo';
  $this->drupalGet('file-test/upload');
  $this->submitForm($edit, 'Submit');
  $this->assertSession()
    ->statusCodeEquals(200);
  $this->assertSession()
    ->responseContains('Only files with the following extensions are allowed: <em class="placeholder">' . $edit['extensions'] . '</em>');
  $this->assertSession()
    ->pageTextContains("Epic upload FAIL!");
  // Check that the correct hooks were called.
  $this->assertFileHooksCalled([
    'validate',
  ]);
  // Reset the hook counters.
  file_test_reset();
  // Turn off insecure uploads, then try the same thing as above (ensure that
  // the .php file is still rejected since it's not in the list of allowed
  // extensions).
  $config->set('allow_insecure_uploads', 0)
    ->save();
  $this->drupalGet('file-test/upload');
  $this->submitForm($edit, 'Submit');
  $this->assertSession()
    ->statusCodeEquals(200);
  $this->assertSession()
    ->responseContains('Only files with the following extensions are allowed: <em class="placeholder">' . $edit['extensions'] . '</em>');
  $this->assertSession()
    ->pageTextContains("Epic upload FAIL!");
  // Check that the correct hooks were called.
  $this->assertFileHooksCalled([
    'validate',
  ]);
  // Reset the hook counters.
  file_test_reset();
  \Drupal::service('cache.config')->deleteAll();
  $edit = [
    'file_test_replace' => FileExists::Replace->name,
    'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->phpFile->uri),
    'is_image_file' => FALSE,
    'extensions' => 'php',
  ];
  $this->drupalGet('file-test/upload');
  $this->submitForm($edit, 'Submit');
  $this->assertSession()
    ->statusCodeEquals(200);
  $this->assertSession()
    ->pageTextContains('For security reasons, your upload has been rejected.');
  $this->assertSession()
    ->pageTextContains('Epic upload FAIL!');
  // Check that the correct hooks were called.
  $this->assertFileHooksCalled([
    'validate',
  ]);
}