function SaveUploadTest::testHandleExtension

Tests extension handling.

File

core/modules/file/tests/src/Functional/SaveUploadTest.php, line 198

Class

SaveUploadTest

Tests the file_save_upload() function.

Namespace

Code

public function testHandleExtension() {
    // The file being tested is a .gif which is in the default safe list
    // of extensions to allow when the extension validator isn't used. This is
    // implicitly tested at the testNormal() test. Here we tell
    // file_save_upload() to only allow ".foo".
    $extensions = 'foo';
    $edit = [
        'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
        'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->image
            ->getFileUri()),
        'extensions' => $extensions,
    ];
    $this->drupalGet('file-test/upload');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->responseContains('Only files with the following extensions are allowed: <em class="placeholder">' . $extensions . '</em>');
    $this->assertSession()
        ->pageTextContains("Epic upload FAIL!");
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
    ]);
    // Reset the hook counters.
    file_test_reset();
    $extensions = 'foo ' . $this->imageExtension;
    // Now tell file_save_upload() to allow the extension of our test image.
    $edit = [
        'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
        'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->image
            ->getFileUri()),
        'extensions' => $extensions,
    ];
    $this->drupalGet('file-test/upload');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->pageTextNotContains("Only files with the following extensions are allowed:");
    $this->assertSession()
        ->pageTextContains("You WIN!");
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
        'load',
        'update',
    ]);
    // Reset the hook counters.
    file_test_reset();
    // Now tell file_save_upload() to allow any extension.
    $edit = [
        'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
        'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->image
            ->getFileUri()),
        'allow_all_extensions' => 'empty_array',
    ];
    $this->drupalGet('file-test/upload');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->pageTextNotContains("Only files with the following extensions are allowed:");
    $this->assertSession()
        ->pageTextContains("You WIN!");
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
        'load',
        'update',
    ]);
    // Reset the hook counters.
    file_test_reset();
    // Now tell file_save_upload() to allow any extension and try and upload a
    // malicious file.
    $edit = [
        'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
        'files[file_test_upload]' => \Drupal::service('file_system')->realpath($this->phpfile->uri),
        'allow_all_extensions' => 'empty_array',
        'is_image_file' => FALSE,
    ];
    $this->drupalGet('file-test/upload');
    $this->submitForm($edit, 'Submit');
    $this->assertSession()
        ->statusCodeEquals(200);
    $this->assertSession()
        ->responseContains('For security reasons, your upload has been renamed to <em class="placeholder">' . $this->phpfile->filename . '_.txt' . '</em>');
    $this->assertSession()
        ->pageTextContains('File name is php-2.php_.txt.');
    $this->assertSession()
        ->pageTextContains('File MIME type is text/plain.');
    $this->assertSession()
        ->pageTextContains("You WIN!");
    // Check that the correct hooks were called.
    $this->assertFileHooksCalled([
        'validate',
        'insert',
    ]);
}