FileDeleteGadgetChainTest.php

<?php

declare (strict_types=1);
// cSpell:ignore phpggc
namespace Drupal\KernelTests\Core\File;

use Drupal\KernelTests\KernelTestBase;

/**
 * Tests protection against SA-CORE-2024-006 File Delete Gadget Chain.
 *
 * @group file
 */
class FileDeleteGadgetChainTest extends KernelTestBase {
  
  /**
   * Tests unserializing a File Delete payload.
   */
  public function testFileDeleteGadgetChain() : void {
    file_put_contents('public://canary.txt', 'now you see me');
    // ./phpggc --public-properties Drupal/FD1 public://canary.txt
    $payload = 'O:34:"Drupal\\Core\\Config\\StorageComparer":1:{s:18:"targetCacheStorage";O:39:"Drupal\\Component\\PhpStorage\\FileStorage":1:{s:9:"directory";s:19:"public://canary.txt";}}';
    try {
      unserialize($payload);
      $this->fail('No exception was thrown');
    } catch (\Throwable $e) {
      $this->assertInstanceOf(\TypeError::class, $e);
      $this->assertStringContainsString('Cannot assign Drupal\\Component\\PhpStorage\\FileStorage to property Drupal\\Core\\Config\\StorageComparer::$targetCacheStorage', $e->getMessage());
    }
    $this->assertTrue(file_exists('public://canary.txt'));
    unlink('public://canary.txt');
  }

}