function SaveUploadTest::testHandleDotFile

Test dangerous file handling.

File

core/modules/file/tests/src/Functional/SaveUploadTest.php, line 388

Class

SaveUploadTest

Tests the <a href="/api/drupal/core%21modules%21file%21file.module/function/file_save_upload/11.x" title="Saves file uploads to a new location." class="local">file_save_upload</a>() function.

Namespace

Code

public function testHandleDotFile() : void {
    $dot_file = $this->siteDirectory . '/.test';
    file_put_contents($dot_file, 'This is a test');
    $config = $this->config('system.file');
    $edit = [
        'file_test_replace' => FileExists::Replace->name,
        'files[file_test_upload]' => \Drupal::service('file_system')->realpath($dot_file),
        'is_image_file' => FALSE,
    ];
    $this->drupalGet('file-test/upload');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->pageTextContains('The specified file .test could not be uploaded');
    $this->assertSession()
        ->pageTextContains('Epic upload FAIL!');
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
    ]);
    $edit = [
        'file_test_replace' => FileExists::Rename->name,
        'files[file_test_upload]' => \Drupal::service('file_system')->realpath($dot_file),
        'is_image_file' => FALSE,
        'allow_all_extensions' => 'empty_array',
    ];
    $this->drupalGet('file-test/upload');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->pageTextContains('For security reasons, your upload has been renamed to test.');
    $this->assertSession()
        ->pageTextContains('File name is test.');
    $this->assertSession()
        ->pageTextContains('You WIN!');
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
        'insert',
    ]);
    // Reset the hook counters.
    file_test_reset();
    // Turn off insecure uploads, then try the same thing as above to ensure dot
    // files are renamed regardless.
    $config->set('allow_insecure_uploads', 0)
        ->save();
    $this->drupalGet('file-test/upload');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->pageTextContains('For security reasons, your upload has been renamed to test_0.');
    $this->assertSession()
        ->pageTextContains('File name is test_0.');
    $this->assertSession()
        ->pageTextContains('You WIN!');
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
        'insert',
    ]);
    // Reset the hook counters.
    file_test_reset();
}