Issue #3330139 by omkar.podey, Wim Leers: Harden...

Issue #3330139 by omkar.podey, Wim Leers: Harden PathExclusionsTrait::excludeInProjectRoot() for paths outside of project root

automatic_updates_extensions/tests/src/Kernel/ExtensionUpdaterTest.php

@@ -45,8 +45,6 @@ class ExtensionUpdaterTest extends AutomaticUpdatesExtensionsKernelTestBase {
     // Create a user who will own the stage even after the container is rebuilt.
     $user = $this->createUser([], NULL, TRUE, ['uid' => 2]);
     $this->setCurrentUser($user);
-
-    $this->createVirtualProject(__DIR__ . '/../../fixtures/fake-site');
   }
 
   /**
@@ -162,7 +160,6 @@ class ExtensionUpdaterTest extends AutomaticUpdatesExtensionsKernelTestBase {
    * @dataProvider providerUpdateException
    */
   public function testUpdateException(string $event_class): void {
-    $this->createVirtualProject(__DIR__ . '/../../fixtures/fake-site');
     $extension_updater = $this->container->get('automatic_updates_extensions.updater');
     $results = [
       ValidationResult::createError(['An error of some sorts.']),

package_manager/src/PathExcluder/PathExclusionsTrait.php

@@ -65,6 +65,12 @@ trait PathExclusionsTrait {
     $project_root = $this->pathLocator->getProjectRoot();
 
     foreach ($paths as $path) {
+      if (str_starts_with($path, '/') || str_starts_with($path, 'vfs:')) {
+        if (!str_starts_with($path, $project_root)) {
+          throw new \LogicException("$path is not inside the project root: $project_root.");
+        }
+      }
+
       // Make absolute paths relative to the project root.
       $path = str_replace($project_root, '', $path);
       $path = ltrim($path, '/');

package_manager/src/PathExcluder/SqliteDatabaseExcluder.php

@@ -61,6 +61,10 @@ class SqliteDatabaseExcluder implements EventSubscriberInterface {
     // and we should ignore it. Always treat it as relative to the project root.
     if ($this->database->driver() === 'sqlite') {
       $options = $this->database->getConnectionOptions();
+      // Nothing to exclude if the database lives outside the project root.
+      if (str_starts_with($options['database'], '/') && !str_starts_with($options['database'], $this->pathLocator->getProjectRoot())) {
+        return;
+      }
       $this->excludeInProjectRoot($event, [
         $options['database'],
         $options['database'] . '-shm',

package_manager/tests/src/Kernel/PackageManagerKernelTestBase.php

@@ -5,6 +5,7 @@ declare(strict_types = 1);
 namespace Drupal\Tests\package_manager\Kernel;
 
 use Drupal\Core\DependencyInjection\ContainerBuilder;
+use Drupal\Core\Site\Settings;
 use Drupal\KernelTests\KernelTestBase;
 use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\StageEvent;
@@ -236,8 +237,20 @@ abstract class PackageManagerKernelTestBase extends KernelTestBase {
     $active_dir = vfsStream::newDirectory('active');
     $this->vfsRoot->addChild($active_dir);
     $active_dir = $active_dir->url();
+    // Move vfs://root/sites to vfs://root/active/sites.
+    $sites_in_vfs = vfsStream::url('root/sites');
+    rename($sites_in_vfs, $sites_in_vfs . '/active');
     static::copyFixtureFilesTo($source_dir, $active_dir);
 
+    // Override siteDirectory to point to root/active/... instead of root/... .
+    $test_site_path = str_replace('vfs://root/', '', $this->siteDirectory);
+    $this->siteDirectory = vfsStream::url('root/active/' . $test_site_path);
+    // Override KernelTestBase::setUpFilesystem's Settings object.
+    $settings = Settings::getInstance() ? Settings::getAll() : [];
+    $settings['file_public_path'] = $this->siteDirectory . '/files';
+    $settings['config_sync_directory'] = $this->siteDirectory . '/files/config/sync';
+    new Settings($settings);
+
     // Create a stage root directory alongside the active directory.
     $stage_dir = vfsStream::newDirectory('stage');
     $this->vfsRoot->addChild($stage_dir);