protected function FileFieldWidgetTestCase::doTestTemporaryFileRemovalExploit

Helper for testing exploiting the temporary file removal using fid.

Parameters

int $victim_uid: The victim user ID.

int $attacker_uid: The attacker user ID.

File

modules/file/tests/file.test, line 767

Tests for file.module.

Class

FileFieldWidgetTestCase

Tests file field widget.

Code

protected function doTestTemporaryFileRemovalExploit($victim_uid, $attacker_uid) {
  // Use 'page' instead of 'post', so that the 'post' image field does
  // not conflict with this test. If in the future the 'page' type gets its
  // own default file or image field, this test can be made more robust by
  // using a custom node type.
  $type_name = 'page';
  $field_name = 'test_file_field';
  $this->createFileField($field_name, $type_name);

  $test_file = $this->getTestFile('text');
  foreach (array('nojs', 'js') as $type) {
    // Create a temporary file owned by the anonymous victim user. This will be
    // as if they had uploaded the file, but not saved the node they were
    // editing or creating.
    $victim_tmp_file = $this->createTemporaryFile('some text', $victim_uid);
    $victim_tmp_file = file_load($victim_tmp_file->fid);
    $this->assertTrue($victim_tmp_file->status != FILE_STATUS_PERMANENT, 'New file saved to disk is temporary.');
    $this->assertFalse(empty($victim_tmp_file->fid), 'New file has a fid');
    $this->assertEqual($victim_uid, $victim_tmp_file->uid, 'New file belongs to the victim user');

    // Have attacker create a new node with a different uploaded file and
    // ensure it got uploaded successfully.
    $edit = array(
      'title' => $type . '-title',
    );

    // Attach a file to a node.
    $langcode = LANGUAGE_NONE;
    $edit['files[' . $field_name . '_' . $langcode . '_0]'] = backdrop_realpath($test_file->uri);
    $this->backdropPost("node/add/$type_name", $edit, 'Save');
    $node = $this->backdropGetNodeByTitle($edit['title']);
    $node_file = file_load($node->{$field_name}[$langcode][0]['fid']);
    $this->assertFileExists($node_file, 'New file saved to disk on node creation.');
    $this->assertEqual($attacker_uid, $node_file->uid, 'New file belongs to the attacker.');

    // Ensure the file can be downloaded.
    $this->backdropGet(file_create_url($node_file->uri));
    $this->assertResponse(200, 'Confirmed that the generated URL is correct by downloading the shipped file.');

    // "Click" the remove button (emulating either a nojs or js submission).
    // In this POST request, the attacker "guesses" the fid of the victim's
    // temporary file and uses that to remove this file.
    $this->backdropGet('node/' . $node->nid . '/edit');
    switch ($type) {
      case 'nojs':
        $this->backdropPost(NULL, array("{$field_name}[$langcode][0][fid]" => (string) $victim_tmp_file->fid), 'Remove');
        break;
      case 'js':
        $button = $this->xpath('//input[@type="submit" and @value="Remove"]');
        $this->backdropPostAJAX(NULL, array("{$field_name}[$langcode][0][fid]" => (string) $victim_tmp_file->fid), array((string) $button[0]['name'] => (string) $button[0]['value']));
        break;
    }

    // The victim's temporary file should not be removed by the attacker's
    // POST request.
    $this->assertFileExists($victim_tmp_file);
  }
}