function FileCookieJarShimTest::testUnserializedInstanceDoesNotAutoSave

An unserialized jar must not auto-save (the gadget chain sink).

This is the key security assertion: __wakeup() disables auto-save so that destroying an unserialized FileCookieJar with an attacker-controlled filename performs no file write.

File

core/tests/Drupal/Tests/Component/Cookie/FileCookieJarShimTest.php, line 113

Class

FileCookieJarShimTest

Tests the hardened backport of \GuzzleHttp\Cookie\FileCookieJar.

Namespace

Code

public function testUnserializedInstanceDoesNotAutoSave() : void {
  // Payload uses similar technique to phpggc's --public-properties to avoid
  // null bytes.
  $payload = sprintf('O:%d:"%s":2:{s:8:"filename";s:%d:"%s";s:19:"storeSessionCookies";b:1;}', strlen(FileCookieJar::class), FileCookieJar::class, strlen($this->file), $this->file);
  $object = unserialize($payload);
  $this->assertInstanceOf(FileCookieJar::class, $object);
  $reflection = new \ReflectionObject($object);
  // Confirm the payload actually populated the private $filename, i.e. the
  // gadget is armed and would write to $this->file if not for __wakeup().
  $this->assertSame($this->file, $reflection->getProperty('filename')
    ->getValue($object), 'The payload set the private $filename — the gadget is armed.');
  $this->assertFalse($reflection->getProperty('autoSave')
    ->getValue($object), '__wakeup() must disable auto-save on unserialized instances.');
  // Force destruction.
  unset($object);
  gc_collect_cycles();
  $this->assertFileDoesNotExist($this->file, 'Destroying an unserialized FileCookieJar must not write to the attacker-controlled path.');
}