function SaveUploadTest::testHandleFileMunge
Same name in other branches
- 8.9.x core/modules/file/tests/src/Functional/SaveUploadTest.php \Drupal\Tests\file\Functional\SaveUploadTest::testHandleFileMunge()
- 10 core/modules/file/tests/src/Functional/SaveUploadTest.php \Drupal\Tests\file\Functional\SaveUploadTest::testHandleFileMunge()
- 11.x core/modules/file/tests/src/Functional/SaveUploadTest.php \Drupal\Tests\file\Functional\SaveUploadTest::testHandleFileMunge()
Tests file munge handling.
File
-
core/
modules/ file/ tests/ src/ Functional/ SaveUploadTest.php, line 431
Class
- SaveUploadTest
- Tests the file_save_upload() function.
Namespace
Drupal\Tests\file\FunctionalCode
public function testHandleFileMunge() {
// Ensure insecure uploads are disabled for this test.
$this->config('system.file')
->set('allow_insecure_uploads', 0)
->save();
$original_image_uri = $this->image
->getFileUri();
/** @var \Drupal\file\FileRepositoryInterface $file_repository */
$file_repository = \Drupal::service('file.repository');
$this->image = $file_repository->move($this->image, $original_image_uri . '.foo.' . $this->imageExtension);
// Reset the hook counters to get rid of the 'move' we just called.
file_test_reset();
$extensions = $this->imageExtension;
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->image
->getFileUri()),
'extensions' => $extensions,
];
$munged_filename = $this->image
->getFilename();
$munged_filename = substr($munged_filename, 0, strrpos($munged_filename, '.'));
$munged_filename .= '_.' . $this->imageExtension;
$this->drupalGet('file-test/upload');
$this->submitForm($edit, 'Submit');
$this->assertSession()
->statusCodeEquals(200);
$this->assertSession()
->pageTextContains('For security reasons, your upload has been renamed');
$this->assertSession()
->pageTextContains("File name is {$munged_filename}");
$this->assertSession()
->pageTextContains("You WIN!");
// Check that the correct hooks were called.
$this->assertFileHooksCalled([
'validate',
'insert',
]);
// Reset the hook counters.
file_test_reset();
// Ensure we don't munge the .foo extension if it is in the list of allowed
// extensions.
$extensions = 'foo ' . $this->imageExtension;
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->image
->getFileUri()),
'extensions' => $extensions,
];
$this->drupalGet('file-test/upload');
$this->submitForm($edit, 'Submit');
$this->assertSession()
->statusCodeEquals(200);
$this->assertSession()
->pageTextNotContains('For security reasons, your upload has been renamed');
$this->assertSession()
->pageTextContains("File name is {$this->image->getFilename()}");
$this->assertSession()
->pageTextContains("You WIN!");
// Check that the correct hooks were called.
$this->assertFileHooksCalled([
'validate',
'insert',
]);
// Ensure we don't munge files if we're allowing any extension.
$this->image = $file_repository->move($this->image, $original_image_uri . '.foo.txt.' . $this->imageExtension);
// Reset the hook counters.
file_test_reset();
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->image
->getFileUri()),
'allow_all_extensions' => 'empty_array',
];
$this->drupalGet('file-test/upload');
$this->submitForm($edit, 'Submit');
$this->assertSession()
->statusCodeEquals(200);
$this->assertSession()
->pageTextNotContains('For security reasons, your upload has been renamed');
$this->assertSession()
->pageTextContains("File name is {$this->image->getFilename()}");
$this->assertSession()
->pageTextContains("You WIN!");
// Check that the correct hooks were called.
$this->assertFileHooksCalled([
'validate',
'insert',
]);
// Test that a dangerous extension such as .php is munged even if it is in
// the list of allowed extensions.
$this->image = $file_repository->move($this->image, $original_image_uri . '.php.' . $this->imageExtension);
// Reset the hook counters.
file_test_reset();
$extensions = 'php ' . $this->imageExtension;
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->image
->getFileUri()),
'extensions' => $extensions,
];
$this->drupalGet('file-test/upload');
$this->submitForm($edit, 'Submit');
$this->assertSession()
->statusCodeEquals(200);
$this->assertSession()
->pageTextContains('For security reasons, your upload has been renamed');
$this->assertSession()
->pageTextContains("File name is image-test.png_.php_.png");
$this->assertSession()
->pageTextContains("You WIN!");
// Check that the correct hooks were called.
$this->assertFileHooksCalled([
'validate',
'insert',
]);
// Reset the hook counters.
file_test_reset();
// Dangerous extensions are munged even when all extensions are allowed.
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->image
->getFileUri()),
'allow_all_extensions' => 'empty_array',
];
$this->drupalGet('file-test/upload');
$this->submitForm($edit, 'Submit');
$this->assertSession()
->statusCodeEquals(200);
$this->assertSession()
->pageTextContains('For security reasons, your upload has been renamed');
$this->assertSession()
->pageTextContains("File name is image-test.png_.php__0.png");
$this->assertSession()
->pageTextContains("You WIN!");
// Check that the correct hooks were called.
$this->assertFileHooksCalled([
'validate',
'insert',
]);
// Dangerous extensions are munged if is renamed to end in .txt.
$this->image = $file_repository->move($this->image, $original_image_uri . '.cgi.' . $this->imageExtension . '.txt');
// Reset the hook counters.
file_test_reset();
// Dangerous extensions are munged even when all extensions are allowed.
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->image
->getFileUri()),
'allow_all_extensions' => 'empty_array',
];
$this->drupalGet('file-test/upload');
$this->submitForm($edit, 'Submit');
$this->assertSession()
->statusCodeEquals(200);
$this->assertSession()
->pageTextContains('For security reasons, your upload has been renamed');
$this->assertSession()
->pageTextContains("File name is image-test.png_.cgi_.png_.txt");
$this->assertSession()
->pageTextContains("You WIN!");
// Check that the correct hooks were called.
$this->assertFileHooksCalled([
'validate',
'insert',
]);
// Reset the hook counters.
file_test_reset();
// Ensure that setting $validators['file_validate_extensions'] = ['']
// rejects all files without munging or renaming.
$edit = [
'files[file_test_upload][]' => \Drupal::service('file_system')->realpath($this->image
->getFileUri()),
'allow_all_extensions' => 'empty_string',
];
$this->drupalGet('file-test/save_upload_from_form_test');
$this->submitForm($edit, 'Submit');
$this->assertSession()
->statusCodeEquals(200);
$this->assertSession()
->pageTextNotContains('For security reasons, your upload has been renamed');
$this->assertSession()
->pageTextContains("Epic upload FAIL!");
// Check that the correct hooks were called.
$this->assertFileHooksCalled([
'validate',
]);
}
Buggy or inaccurate documentation? Please file an issue. Need support? Need help programming? Connect with the Drupal community.