Verified Commit dfcdf21f authored by catch's avatar catch Committed by Jess
Browse files

task: #3633166 Add test coverage for SA-CORE-2026-009 

By: xjm
By: kim.pepper
By: bbrala
By: larowlan
By: smustgrave
(cherry picked from commit 661002c9)
parent d3e51377

core/modules/jsonapi/tests/src/Functional/FileUploadTest.php

+46 −0
Changes for core/modules/jsonapi/tests/src/Functional/FileUploadTest.php: 46 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -699,6 +699,52 @@ protected function testFileUploadMaliciousExtension(): void { 
    $this->assertFileExists('public://foobar/example_7.php');

  }



  /**

   * Tests using the image upload POST route with a malicious image.

   */

  public function testImageUploadMaliciousContent(): void {

    $this->container->get('module_installer')->install(['image']);



    \Drupal::service('router.builder')->rebuild();

    $this->setUpAuthorization('POST');

    $this->config('jsonapi.settings')->set('read_only', FALSE)->save();



    // Add a file field.

    $imageStorage = FieldStorageConfig::create([

      'entity_type' => 'entity_test',

      'field_name' => 'field_rest_image_test',

      'type' => 'image',

      'settings' => [

        'uri_scheme' => 'public',

      ],

    ])

      ->setCardinality(FieldStorageDefinitionInterface::CARDINALITY_UNLIMITED);

    $imageStorage->save();



    $imageField = FieldConfig::create([

      'entity_type' => 'entity_test',

      'field_name' => 'field_rest_image_test',

      'bundle' => 'entity_test',

      'settings' => [

        'file_directory' => 'field_rest_image_test',

        'file_extensions' => '',

        'max_filesize' => '',

      ],

    ])

      ->setLabel('Test image field')

      ->setTranslatable(FALSE);

    $imageField->save();



    $uri = Url::fromUri('base:/jsonapi/entity_test/entity_test/field_rest_image_test');



    $php_string = '<?php print "Drupal"; ?>';



    // Test using a masked exploit file.

    $response = $this->fileRequest($uri, $php_string, ['Content-Disposition' => 'filename="example.png"']);

    $this->assertSame(422, $response->getStatusCode());

    $this->assertFileDoesNotExist('public://field_rest_image_test/example.png');

  }



  /**

   * Tests using the file upload POST route no configuration.

   */