task: #3522220 Add tests for SA-CORE-2025-003

<?php

declare(strict_types=1);

// cSpell:ignore PHPGGC's, phpggc

namespace Drupal\KernelTests\Core\Extension;

use Drupal\Core\Site\Settings;

use Drupal\KernelTests\KernelTestBase;

use PHPUnit\Framework\Attributes\DataProvider;

use PHPUnit\Framework\Attributes\Group;

use PHPUnit\Framework\Attributes\IgnoreDeprecations;

use PHPUnit\Framework\Attributes\RunTestsInSeparateProcesses;

/**

 * Tests protection against Drupal/FI1 gadget chain.

 */

#[Group('File')]

#[RunTestsInSeparateProcesses]

class FileIncludeGadgetChainTest extends KernelTestBase {

  /**

   * Provider for paths to include.

   *

   * @return array

   *   Paths for test files to try and include with the gadget chain.

   */

  public static function providerIncludePaths(): array {

    return [

      ['public://cuckoo.txt'],

      ['PUBLIC_PLACEHOLDER/cuckoo.jpg'],

    ];

  }

  /**

   * Tests unserializing a Drupal/FI1 payload.

   */

  #[DataProvider('providerIncludePaths')]

  #[IgnoreDeprecations]

  public function testFileDeleteGadgetChain(string $path): void {

    $path = str_replace('PUBLIC_PLACEHOLDER', Settings::get('file_public_path'), $path);

    // cspell:disable-next-line

    file_put_contents($path, "<?php print base64_decode('dGhpcyBzaG91bGQgbm90IGJl');?>");

    $output = '';

    // ./phpggc Drupal/FI1 public://canary.txt

    $payload = 'O:36:"Drupal\views\DisplayPluginCollection":1:{s:15:"pluginInstances";a:1:{i:0;O:36:"Drupal\Core\Extension\ProceduralCall":1:{s:8:"includes";a:1:{s:7:"destroy";PATH_PLACEHOLDER;}}}}';

    // e.g. s:19:"public://cuckoo.txt"

    $payload = str_replace('PATH_PLACEHOLDER', 's:' . strlen($path) . ':"' . $path . '"', $payload);

    ob_start();

    try {

      unserialize($payload);

    }

    catch (\Throwable) {

      // Error: Call to undefined function \destroy()

      // BadMethodCallException: Cannot unserialize Drupal\Core\Extension\ProceduralCall

    }

    $output = ob_get_clean();

    $this->assertNotEquals('this should not be', $output);

  }

}