function SecurityFileUploadEventSubscriberTest::provideFilenames

Provides data for testSanitizeName().

Return value

array Arrays with original name, allowed extensions, expected name and (optional) expected name 'allow_insecure_uploads' is set to TRUE.

File

core/modules/system/tests/src/Unit/Event/SecurityFileUploadEventSubscriberTest.php, line 74

Class

SecurityFileUploadEventSubscriberTest

SecurityFileUploadEventSubscriber tests.

Namespace

Code

public static function provideFilenames() : array {
  return [
    'All extensions allowed filename not munged' => [
      'foo.txt',
      '',
      'foo.txt',
    ],
    'All extensions allowed with .php file' => [
      'foo.php',
      '',
      'foo.php_.txt',
      'foo.php',
    ],
    'All extensions allowed with .pHp file' => [
      'foo.pHp',
      '',
      'foo.pHp_.txt',
      'foo.pHp',
    ],
    'All extensions allowed with .PHP file' => [
      'foo.PHP',
      '',
      'foo.PHP_.txt',
      'foo.PHP',
    ],
    '.php extension allowed with .php file' => [
      'foo.php',
      'php',
      'foo.php',
      'foo.php',
    ],
    '.PhP extension allowed with .php file' => [
      'foo.php',
      'PhP',
      'foo.php',
      'foo.php',
    ],
    '.php, .txt extension allowed with .php file' => [
      'foo.php',
      'php txt',
      'foo.php_.txt',
      'foo.php',
    ],
    '.PhP, .tXt extension allowed with .php file' => [
      'foo.php',
      'PhP tXt',
      'foo.php_.txt',
      'foo.php',
    ],
    'no extension produces no errors' => [
      'foo',
      '',
      'foo',
    ],
    'filename is munged' => [
      'foo.phar.png.php.jpg',
      'jpg png',
      'foo.phar_.png_.php_.jpg',
    ],
    'filename is munged regardless of case' => [
      'FOO.pHAR.PNG.PhP.jpg',
      'jpg png',
      'FOO.pHAR_.PNG_.PhP_.jpg',
    ],
    'null bytes are removed even if some extensions are allowed' => [
      'foo' . chr(0) . '.html' . chr(0),
      'txt',
      'foo.html',
    ],
    'dot files are renamed' => [
      '.git',
      '',
      'git',
    ],
    'htaccess files are renamed even if allowed' => [
      '.htaccess',
      'htaccess txt',
      'htaccess',
    ],
    '.phtml extension allowed with .phtml file' => [
      'foo.phtml',
      'phtml',
      'foo.phtml',
    ],
    '.phtml, .txt extension allowed with .phtml file' => [
      'foo.phtml',
      'phtml txt',
      'foo.phtml_.txt',
      'foo.phtml',
    ],
    'All extensions allowed with .phtml file' => [
      'foo.phtml',
      '',
      'foo.phtml_.txt',
      'foo.phtml',
    ],
    'dot files are renamed even if allowed and not in security list' => [
      '.git',
      'git',
      'git',
    ],
    // Characters that are never safe are replaced regardless of the
    // filename_sanitization settings in file.settings.
'Carriage return is replaced' => [
      "a\rb.txt",
      'txt',
      'a_b.txt',
    ],
    'Tab is replaced' => [
      "a\tb.txt",
      'txt',
      'a_b.txt',
    ],
    'Delete is replaced' => [
      "ab.txt",
      'txt',
      'a_b.txt',
    ],
    'Shell meta-characters are replaced' => [
      'a;b|c&d.txt',
      'txt',
      'a_b_c_d.txt',
    ],
    'Backtick and dollar are replaced' => [
      'a`b$c.txt',
      'txt',
      'a_b_c.txt',
    ],
    'Quotes are replaced' => [
      'a\'b"c.txt',
      'txt',
      'a_b_c.txt',
    ],
    'Bidirectional override is replaced' => [
      "photo_‮gnp.txt",
      'txt',
      'photo__gnp.txt',
    ],
    'Zero width space is replaced' => [
      "photo​graph.txt",
      'txt',
      'photo_graph.txt',
    ],
    'An ampersand is replaced, not dropped' => [
      'Love&War.pdf',
      'pdf',
      'Love_War.pdf',
    ],
    'A name of only unsafe characters keeps its extension' => [
      '<>|.txt',
      'txt',
      '___.txt',
    ],
    'A name of only unsafe characters is not emptied' => [
      '<>|',
      '',
      '___',
    ],
    'Leading dashes are stripped' => [
      '--opt.txt',
      'txt',
      'opt.txt',
    ],
    'Leading dashes do not expose a dot file' => [
      '---.txt',
      'txt',
      'unnamed.txt',
    ],
    'A name of only dots falls back' => [
      '...',
      '',
      'unnamed',
    ],
    'The fallback name is not itself disturbed' => [
      'unnamed',
      '',
      'unnamed',
    ],
    // The extension is still munged after the replacements.
'Unsafe characters with a disallowed insecure extension' => [
      "a\rb.php",
      'txt',
      'a_b.php',
    ],
    'Unsafe characters with an insecure extension' => [
      "a\rb.php",
      '',
      'a_b.php_.txt',
      'a_b.php',
    ],
    'An ordinary filename is untouched' => [
      'holiday-photo.jpg',
      'jpg',
      'holiday-photo.jpg',
    ],
    'Spaces are left to the sanitization settings' => [
      'drupal rocks.txt',
      'txt',
      'drupal rocks.txt',
    ],
  ];
}