Verified Commit d1b9e9b3 authored by Lee Rowlands's avatar Lee Rowlands
Browse files

Issue #3370043 by catch, Chi: Asset controller should validate filename prefix 

(cherry picked from commit 2e3dea7a)
parent cf40e687

core/lib/Drupal/Core/Asset/JsCollectionOptimizerLazy.php

+2 −0
Original line number Diff line number Diff line
@@ -133,6 +133,8 @@ public function optimize(array $js_assets, array $libraries) { 
            'scope' => $js_asset['scope'] === 'header' ? 'header' : 'footer',

            'delta' => "$order",

          ] + $query_args;

          // Add a filename prefix to mitigate ad blockers which can block

          // any script beginning with 'ad'.

          $filename = 'js_' . $this->generateHash($js_asset) . '.js';

          $uri = 'assets://js/' . $filename;

          $js_assets[$order]['data'] = $this->fileUrlGenerator->generateString($uri) . '?' . UrlHelper::buildQuery($query);

core/modules/system/src/Controller/AssetControllerBase.php

+4 −0
Original line number Diff line number Diff line
@@ -136,6 +136,10 @@ public function deliver(Request $request, string $file_name) { 
      throw new BadRequestHttpException('The libraries to include must be passed as a query argument');

    }

    $file_parts = explode('_', basename($file_name, '.' . $this->fileExtension), 2);

    // Ensure the filename is correctly prefixed.

    if ($file_parts[0] !== $this->fileExtension) {

      throw new BadRequestHttpException('The filename prefix must match the file extension');

    }



    // The hash is the second segment of the filename.

    if (!isset($file_parts[1])) {

core/tests/Drupal/FunctionalTests/Asset/AssetOptimizationTest.php

+16 −0
Original line number Diff line number Diff line
@@ -163,6 +163,9 @@ protected function assertInvalidAggregates(string $url): void { 
    $session->visit($this->invalidExclude($url));

    $this->assertSession()->statusCodeEquals(400);



    $session->visit($this->replaceFileNamePrefix($url));

    $this->assertSession()->statusCodeEquals(400);



    $session->visit($this->setInvalidLibrary($url));

    $this->assertSession()->statusCodeEquals(200);
@@ -210,6 +213,19 @@ protected function replaceGroupHash(string $url): string { 
    return $this->getAbsoluteUrl(implode('_', $parts));

  }



  /**

   * Replaces the filename prefix in the given URL.

   *

   * @param string $url

   *   The source URL.

   *

   * @return string

   *   The URL with the file name prefix replaced.

   */

  protected function replaceFileNamePrefix(string $url): string {

    return str_replace(['/css_', '/js_'], '/xyz_', $url);

  }



  /**

   * Replaces the 'include' entry in the given URL with an invalid value.

   *