9.5/_zip_service_test_8php_source.html

<?php

declare(strict_types = 1);

namespace ‪TYPO3\CMS\Core\Tests\Functional\Service\Archive;


/*

 * This file is part of the TYPO3 CMS project.

 *

 * It is free software; you can redistribute it and/or modify it under

 * the terms of the GNU General Public License, either version 2

 * of the License, or any later version.

 *

 * For the full copyright and license information, please read the

 * LICENSE.txt file that was distributed with this source code.

 *

 * The TYPO3 project - inspiring people to share!

 */


use org\bovigo\vfs\vfsStream;

use org\bovigo\vfs\vfsStreamDirectory;

use ‪TYPO3\CMS\Core\Exception\Archive\ExtractException;

use ‪TYPO3\CMS\Core\Service\Archive\ZipService;

use ‪TYPO3\CMS\Core\Utility\GeneralUtility;

use TYPO3\TestingFramework\Core\Functional\FunctionalTestCase;


class ‪ZipServiceTest extends FunctionalTestCase

{

    private ‪$vfs;


    private ‪$directory;


    protected function ‪setUp(): void

    {

        parent::setUp();


        $structure = [

            'typo3conf' => [

                'ext' => [],

            ],

        ];

        $this->vfs = vfsStream::setup('root', null, $structure);

        $this->directory = vfsStream::url('root/typo3conf/ext');

    }


    protected function ‪tearDown(): void

    {

        parent::tearDown();

        unset($this->vfs, $this->directory);

    }


    public function ‪filesCanNotGetExtractedOutsideTargetDirectory(): void

    {

        $extensionDirectory = $this->directory . '/malicious';

        GeneralUtility::mkdir($extensionDirectory);


        (new ZipService())->extract(

            __DIR__ . '/Fixtures/malicious.zip',

            $extensionDirectory

        );

        self::assertFileNotExists($extensionDirectory . '/../tool.php');

        self::assertFileExists($extensionDirectory . '/tool.php');

        // This is a smoke test to verify PHP's zip library is broken regarding symlinks

        self::assertFileExists($extensionDirectory . '/passwd');

        self::assertFalse(is_link($extensionDirectory . '/passwd'));

    }


    public function ‪fileContentIsExtractedAsExpected(): void

    {

        $extensionDirectory = $this->directory . '/my_extension';

        GeneralUtility::mkdir($extensionDirectory);


        (new ZipService())->extract(

            __DIR__ . '/Fixtures/my_extension.zip',

            $extensionDirectory

        );


        self::assertDirectoryExists($extensionDirectory . '/Classes');

        self::assertFileExists($extensionDirectory . '/Resources/Public/Css/empty.css');

        self::assertFileExists($extensionDirectory . '/ext_emconf.php');

    }


    public function ‪fileContentIsExtractedAsExpectedAndSetsPermissions(): void

    {

        ‪$GLOBALS['TYPO3_CONF_VARS']['SYS']['fileCreateMask'] = '0777';

        ‪$GLOBALS['TYPO3_CONF_VARS']['SYS']['folderCreateMask'] = '0772';

        $extensionDirectory = $this->directory . '/my_extension';

        GeneralUtility::mkdir($extensionDirectory);


        (new ZipService())->extract(

            __DIR__ . '/Fixtures/my_extension.zip',

            $extensionDirectory

        );


        self::assertDirectoryExists($extensionDirectory . '/Classes');

        self::assertFileExists($extensionDirectory . '/Resources/Public/Css/empty.css');

        self::assertFileExists($extensionDirectory . '/ext_emconf.php');


        $filePerms = fileperms($extensionDirectory . '/Resources/Public/Css/empty.css');

        $folderPerms = fileperms($extensionDirectory . '/Classes');

        self::assertEquals(‪$GLOBALS['TYPO3_CONF_VARS']['SYS']['fileCreateMask'], substr(sprintf('%o', $filePerms), -4));

        self::assertEquals(‪$GLOBALS['TYPO3_CONF_VARS']['SYS']['folderCreateMask'], substr(sprintf('%o', $folderPerms), -4));

    }


    public function ‪nonExistentFileThrowsException(): void

    {

        $this->expectException(ExtractException::class);

        $this->expectExceptionCode(1565709712);


        (new ZipService())->extract(

            'foobar.zip',

            vfsStream::url('root')

        );

    }


    public function ‪nonExistentDirectoryThrowsException(): void

    {

        $this->expectException(\RuntimeException::class);

        $this->expectExceptionCode(1565773005);


        (new ZipService())->extract(

            __DIR__ . '/Fixtures/my_extension.zip',

            vfsStream::url('root/non-existent-directory')

        );

    }


    public function ‪nonWritableDirectoryThrowsException(): void

    {

        $this->expectException(\RuntimeException::class);

        $this->expectExceptionCode(1565773006);


        $extensionDirectory = $this->directory . '/my_extension';

        GeneralUtility::mkdir($extensionDirectory);

        chmod($extensionDirectory, 0000);


        (new ZipService())->extract(

            __DIR__ . '/Fixtures/my_extension.zip',

            $extensionDirectory

        );

        self::assertFileExists($extensionDirectory . '/Resources/Public/Css/empty.css');

    }


    public function ‪verifyDetectsValidArchive(): void

    {

        self::assertTrue(

            (new ZipService())->verify(__DIR__ . '/Fixtures/my_extension.zip')

        );

    }


    public function ‪verifyDetectsSuspiciousSequences(): void

    {

        $this->expectException(ExtractException::class);

        $this->expectExceptionCode(1565709714);


        (new ZipService())->verify(__DIR__ . '/Fixtures/malicious.zip');

    }

}