function SaveUploadTest::testHandleFileMunge

Tests file munge handling.

File

core/modules/file/tests/src/Functional/SaveUploadTest.php, line 445

Class

SaveUploadTest

Tests the <a href="/api/drupal/core%21modules%21file%21file.module/function/file_save_upload/11.x" title="Saves file uploads to a new location." class="local">file_save_upload</a>() function.

Namespace

Code

public function testHandleFileMunge() : void {
    // Ensure insecure uploads are disabled for this test.
    $this->config('system.file')
        ->set('allow_insecure_uploads', 0)
        ->save();
    $original_image_uri = $this->image
        ->getFileUri();
    
    /** @var \Drupal\file\FileRepositoryInterface $file_repository */
    $file_repository = \Drupal::service('file.repository');
    $this->image = $file_repository->move($this->image, $original_image_uri . '.foo.' . $this->imageExtension);
    // Reset the hook counters to get rid of the 'move' we just called.
    file_test_reset();
    $extensions = $this->imageExtension;
    $edit = [
        'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->image
            ->getFileUri()),
        'extensions' => $extensions,
    ];
    $munged_filename = $this->image
        ->getFilename();
    $munged_filename = substr($munged_filename, 0, strrpos($munged_filename, '.'));
    $munged_filename .= '_.' . $this->imageExtension;
    $this->drupalGet('file-test/upload');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->pageTextContains('For security reasons, your upload has been renamed');
    $this->assertSession()
        ->pageTextContains("File name is {$munged_filename}");
    $this->assertSession()
        ->pageTextContains("You WIN!");
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
        'insert',
    ]);
    // Reset the hook counters.
    file_test_reset();
    // Ensure we don't munge the .foo extension if it is in the list of allowed
    // extensions.
    $extensions = 'foo ' . $this->imageExtension;
    $edit = [
        'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->image
            ->getFileUri()),
        'extensions' => $extensions,
    ];
    $this->drupalGet('file-test/upload');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->pageTextNotContains('For security reasons, your upload has been renamed');
    $this->assertSession()
        ->pageTextContains("File name is {$this->image->getFilename()}");
    $this->assertSession()
        ->pageTextContains("You WIN!");
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
        'insert',
    ]);
    // Ensure we don't munge files if we're allowing any extension.
    $this->image = $file_repository->move($this->image, $original_image_uri . '.foo.txt.' . $this->imageExtension);
    // Reset the hook counters.
    file_test_reset();
    $edit = [
        'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->image
            ->getFileUri()),
        'allow_all_extensions' => 'empty_array',
    ];
    $this->drupalGet('file-test/upload');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->pageTextNotContains('For security reasons, your upload has been renamed');
    $this->assertSession()
        ->pageTextContains("File name is {$this->image->getFilename()}");
    $this->assertSession()
        ->pageTextContains("You WIN!");
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
        'insert',
    ]);
    // Test that a dangerous extension such as .php is munged even if it is in
    // the list of allowed extensions.
    $this->image = $file_repository->move($this->image, $original_image_uri . '.php.' . $this->imageExtension);
    // Reset the hook counters.
    file_test_reset();
    $extensions = 'php ' . $this->imageExtension;
    $edit = [
        'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->image
            ->getFileUri()),
        'extensions' => $extensions,
    ];
    $this->drupalGet('file-test/upload');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->pageTextContains('For security reasons, your upload has been renamed');
    $this->assertSession()
        ->pageTextContains("File name is image-test.png_.php_.png");
    $this->assertSession()
        ->pageTextContains("You WIN!");
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
        'insert',
    ]);
    // Reset the hook counters.
    file_test_reset();
    // Dangerous extensions are munged even when all extensions are allowed.
    $edit = [
        'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->image
            ->getFileUri()),
        'allow_all_extensions' => 'empty_array',
    ];
    $this->drupalGet('file-test/upload');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->pageTextContains('For security reasons, your upload has been renamed');
    $this->assertSession()
        ->pageTextContains("File name is image-test.png_.php__0.png");
    $this->assertSession()
        ->pageTextContains("You WIN!");
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
        'insert',
    ]);
    // Dangerous extensions are munged if is renamed to end in .txt.
    $this->image = $file_repository->move($this->image, $original_image_uri . '.cgi.' . $this->imageExtension . '.txt');
    // Reset the hook counters.
    file_test_reset();
    // Dangerous extensions are munged even when all extensions are allowed.
    $edit = [
        'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->image
            ->getFileUri()),
        'allow_all_extensions' => 'empty_array',
    ];
    $this->drupalGet('file-test/upload');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->pageTextContains('For security reasons, your upload has been renamed');
    $this->assertSession()
        ->pageTextContains("File name is image-test.png_.cgi_.png_.txt");
    $this->assertSession()
        ->pageTextContains("You WIN!");
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
        'insert',
    ]);
    // Reset the hook counters.
    file_test_reset();
    // Ensure that setting $validators['FileExtension'] = ['extensions' = '']
    // rejects all files without munging or renaming.
    $edit = [
        'files[file_test_upload][]' => \Drupal::service('file_system')->realpath($this->image
            ->getFileUri()),
        'allow_all_extensions' => 'empty_string',
    ];
    $this->drupalGet('file-test/save_upload_from_form_test');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->pageTextNotContains('For security reasons, your upload has been renamed');
    $this->assertSession()
        ->pageTextContains("Epic upload FAIL!");
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
    ]);
}