PharStreamWrapperInterceptorTest.php

Go to the documentation of this file.

<?php
 
declare(strict_types=1);
 
/*
 * This file is part of the TYPO3 CMS project.
 *
 * It is free software; you can redistribute it and/or modify it under
 * the terms of the GNU General Public License, either version 2
 * of the License, or any later version.
 *
 * For the full copyright and license information, please read the
 * LICENSE.txt file that was distributed with this source code.
 *
 * The TYPO3 project - inspiring people to share!
 */
 
namespace ‪TYPO3\CMS\Core\Tests\Functional\IO;
 
use TYPO3\PharStreamWrapper\Exception;
use TYPO3\TestingFramework\Core\Functional\FunctionalTestCase;
 
class ‪PharStreamWrapperInterceptorTest extends FunctionalTestCase
{
    protected ‪$initializeDatabase = false;
 
    protected ‪$pathsToProvideInTestInstance = [
        'typo3/sysext/core/Tests/Functional/Fixtures/Extensions/test_resources' => 'typo3conf/ext/test_resources',
        'typo3/sysext/core/Tests/Functional/Fixtures/Extensions/test_resources/bundle.phar' => 'fileadmin/bundle.phar',
    ];
 
    protected function ‪setUp(): void
    {
        parent::setUp();
        if (!in_array('phar', stream_get_wrappers())) {
            self::markTestSkipped('Phar stream wrapper is not registered');
        }
        // PharStreamWrapper is not initialized here since it relies on being
        // properly defined in \TYPO3\CMS\Core\Core\Bootstrap - thus, it tests
        // are expected to fail in case PharStreamWrapper is not initialized
    }
 
    public function ‪directoryActionAllowsInvocationDataProvider(): array
    {
        $allowedPath = 'typo3conf/ext/test_resources/bundle.phar';
 
        return [
            'root directory' => [
                $allowedPath,
                ['Classes', 'Resources'],
            ],
            'Classes/Domain/Model directory' => [
                $allowedPath . '/Classes/Domain/Model',
                ['DemoModel.php'],
            ],
            'Resources directory' => [
                $allowedPath . '/Resources',
                ['content.txt'],
            ],
        ];
    }
 
    public function ‪directoryOpenAllowsInvocation(string $path): void
    {
        $path = $this->instancePath . '/' . $path;
        $handle = opendir('phar://' . $path);
        self::assertIsResource($handle);
    }
 
    public function ‪directoryReadAllowsInvocation(string $path, array $expectation): void
    {
        $path = $this->instancePath . '/' . $path;
 
        $items = [];
        $handle = opendir('phar://' . $path);
        while (false !== $item = readdir($handle)) {
            $items[] = $item;
        }
 
        self::assertSame($expectation, $items);
    }
 
    public function ‪directoryCloseAllowsInvocation(string $path, array $expectation): void
    {
        $path = $this->instancePath . '/' . $path;
 
        $handle = opendir('phar://' . $path);
        closedir($handle);
 
        // Testing with a variable here, otherwise the suggested assertion would be assertIsNotResource
        // which fails.
        $isResource = is_resource($handle);
        self::assertFalse($isResource);
    }
 
    public function ‪directoryActionDeniesInvocationDataProvider(): array
    {
        $deniedPath = 'fileadmin/bundle.phar';
 
        return [
            'root directory' => [
                $deniedPath,
                ['Classes', 'Resources'],
            ],
            'Classes/Domain/Model directory' => [
                $deniedPath . '/Classes/Domain/Model',
                ['DemoModel.php'],
            ],
            'Resources directory' => [
                $deniedPath . '/Resources',
                ['content.txt'],
            ],
        ];
    }
 
    public function ‪directoryActionDeniesInvocation(string $path): void
    {
        $this->expectException(Exception::class);
        $this->expectExceptionCode(1539625084);
 
        $path = $this->instancePath . '/' . $path;
        opendir('phar://' . $path);
    }
 
    public function ‪urlStatAllowsInvocationDataProvider(): array
    {
        $allowedPath = 'typo3conf/ext/test_resources/bundle.phar';
 
        return [
            'filesize base file' => [
                'filesize',
                $allowedPath,
                0, // Phar base file always has zero size when accessed through phar://
            ],
            'filesize Resources/content.txt' => [
                'filesize',
                $allowedPath . '/Resources/content.txt',
                21,
            ],
            'is_file base file' => [
                'is_file',
                $allowedPath,
                false, // Phar base file is not a file when accessed through phar://
            ],
            'is_file Resources/content.txt' => [
                'is_file',
                $allowedPath . '/Resources/content.txt',
                true,
            ],
            'is_dir base file' => [
                'is_dir',
                $allowedPath,
                true, // Phar base file is a directory when accessed through phar://
            ],
            'is_dir Resources/content.txt' => [
                'is_dir',
                $allowedPath . '/Resources/content.txt',
                false,
            ],
            'file_exists base file' => [
                'file_exists',
                $allowedPath,
                true,
            ],
            'file_exists Resources/content.txt' => [
                'file_exists',
                $allowedPath . '/Resources/content.txt',
                true,
            ],
        ];
    }
 
    public function ‪urlStatAllowsInvocation(string $functionName, string $path, $expectation): void
    {
        $path = $this->instancePath . '/' . $path;
 
        self::assertSame(
            $expectation,
            $functionName('phar://' . $path)
        );
    }
 
    public function ‪urlStatDeniesInvocationDataProvider(): array
    {
        $deniedPath = 'fileadmin/bundle.phar';
 
        return [
            'filesize base file' => [
                'filesize',
                $deniedPath,
                0, // Phar base file always has zero size when accessed through phar://
            ],
            'filesize Resources/content.txt' => [
                'filesize',
                $deniedPath . '/Resources/content.txt',
                21,
            ],
            'is_file base file' => [
                'is_file',
                $deniedPath,
                false, // Phar base file is not a file when accessed through phar://
            ],
            'is_file Resources/content.txt' => [
                'is_file',
                $deniedPath . '/Resources/content.txt',
                true,
            ],
            'is_dir base file' => [
                'is_dir',
                $deniedPath,
                true, // Phar base file is a directory when accessed through phar://
            ],
            'is_dir Resources/content.txt' => [
                'is_dir',
                $deniedPath . '/Resources/content.txt',
                false,
            ],
            'file_exists base file' => [
                'file_exists',
                $deniedPath,
                true,
            ],
            'file_exists Resources/content.txt' => [
                'file_exists',
                $deniedPath . '/Resources/content.txt',
                true,
            ],
        ];
    }
 
    public function ‪urlStatDeniesInvocation(string $functionName, string $path): void
    {
        $this->expectException(Exception::class);
        $this->expectExceptionCode(1539625084);
 
        $path = $this->instancePath . '/' . $path;
        $functionName('phar://' . $path);
    }
 
    public function ‪streamOpenAllowsInvocationForFileOpen(): void
    {
        $allowedPath = $this->instancePath . '/typo3conf/ext/test_resources/bundle.phar';
        $handle = fopen('phar://' . $allowedPath . '/Resources/content.txt', 'r');
        self::assertIsResource($handle);
    }
 
    public function ‪streamOpenAllowsInvocationForFileRead(): void
    {
        $allowedPath = $this->instancePath . '/typo3conf/ext/test_resources/bundle.phar';
        $handle = fopen('phar://' . $allowedPath . '/Resources/content.txt', 'r');
        $content = fread($handle, 1024);
        self::assertSame('TYPO3 demo text file.', $content);
    }
 
    public function ‪streamOpenAllowsInvocationForFileEnd(): void
    {
        $allowedPath = $this->instancePath . '/typo3conf/ext/test_resources/bundle.phar';
        $handle = fopen('phar://' . $allowedPath . '/Resources/content.txt', 'r');
        fread($handle, 1024);
        self::assertTrue(feof($handle));
    }
 
    public function ‪streamOpenAllowsInvocationForFileClose(): void
    {
        $allowedPath = $this->instancePath . '/typo3conf/ext/test_resources/bundle.phar';
        $handle = fopen('phar://' . $allowedPath . '/Resources/content.txt', 'r');
        fclose($handle);
        // Testing with a variable here, otherwise the suggested assertion would be assertIsNotResource
        // which fails.
        $isResource = is_resource($handle);
        self::assertFalse($isResource);
    }
 
    public function ‪streamOpenAllowsInvocationForFileGetContents(): void
    {
        $allowedPath = $this->instancePath . '/typo3conf/ext/test_resources/bundle.phar';
        $content = file_get_contents('phar://' . $allowedPath . '/Resources/content.txt');
        self::assertSame('TYPO3 demo text file.', $content);
    }
 
    public function ‪streamOpenAllowsInvocationForInclude(): void
    {
        $allowedPath = $this->instancePath . '/typo3conf/ext/test_resources/bundle.phar';
        include('phar://' . $allowedPath . '/Classes/Domain/Model/DemoModel.php');
 
        self::assertTrue(
            class_exists(
                \TYPO3Demo\Demo\Domain\Model\DemoModel::class,
                false
            )
        );
    }
 
    public function ‪streamOpenDeniesInvocationForFileOpen(): void
    {
        $this->expectException(Exception::class);
        $this->expectExceptionCode(1539625084);
 
        $allowedPath = $this->instancePath . '/fileadmin/bundle.phar';
        fopen('phar://' . $allowedPath . '/Resources/content.txt', 'r');
    }
 
    public function ‪streamOpenDeniesInvocationForFileGetContents(): void
    {
        $this->expectException(Exception::class);
        $this->expectExceptionCode(1539625084);
 
        $allowedPath = $this->instancePath . '/fileadmin/bundle.phar';
        file_get_contents('phar://' . $allowedPath . '/Resources/content.txt');
    }
 
    public function ‪streamOpenDeniesInvocationForIncludeDataProvider(): array
    {
        return [
            'fileadmin/bundle.phar' => ['fileadmin/bundle.phar'],
            'EXT:test_resources/compromised.phar' => ['typo3conf/ext/test_resources/compromised.phar'],
        ];
    }
 
    public function ‪streamOpenDeniesInvocationForInclude(string $path): void
    {
        $this->expectException(Exception::class);
        $this->expectExceptionCode(1539625084);
 
        $allowedPath = $this->instancePath . '/' . $path;
        include('phar://' . $allowedPath . '/Classes/Domain/Model/DemoModel.php');
    }
}