tests/phpunit/includes/upload/UploadBaseTest.php

   1 <?php
   2
   3 use MediaWiki\Interwiki\ClassicInterwikiLookup;
   4 use MediaWiki\MainConfigNames;
   5 use Wikimedia\Mime\XmlTypeCheck;
   6
   7 /**
   8  * @group Upload
   9  */
  10 class UploadBaseTest extends MediaWikiIntegrationTestCase {
  11
  12         protected const UPLOAD_PATH = "/tests/phpunit/data/upload/";
  13
  14         /** @var UploadTestHandler */
  15         protected $upload;
  16
  17         protected function setUp(): void {
  18                 parent::setUp();
  19
  20                 $this->upload = new UploadTestHandler;
  21
  22                 $this->overrideConfigValue(
  23                         MainConfigNames::InterwikiCache,
  24                         ClassicInterwikiLookup::buildCdbHash( [
  25                                 // no entries, no interwiki prefixes
  26                         ] )
  27                 );
  28         }
  29
  30         /**
  31          * First checks the return code
  32          * of UploadBase::getTitle() and then the actual returned title
  33          *
  34          * @dataProvider provideTestTitleValidation
  35          * @covers \UploadBase::getTitle
  36          */
  37         public function testTitleValidation( $srcFilename, $dstFilename, $code, $msg ) {
  38                 /* Check the result code */
  39                 $this->assertEquals( $code,
  40                         $this->upload->testTitleValidation( $srcFilename ),
  41                         "$msg code" );
  42
  43                 /* If we expect a valid title, check the title itself. */
  44                 if ( $code == UploadBase::OK ) {
  45                         $this->assertEquals( $dstFilename,
  46                                 $this->upload->getTitle()->getText(),
  47                                 "$msg text" );
  48                 }
  49         }
  50
  51         /**
  52          * Test various forms of valid and invalid titles that can be supplied.
  53          */
  54         public static function provideTestTitleValidation() {
  55                 return [
  56                         /* Test a valid title */
  57                         [ 'ValidTitle.jpg', 'ValidTitle.jpg', UploadBase::OK,
  58                                 'upload valid title' ],
  59                         /* A title with a slash */
  60                         [ 'A/B.jpg', 'A-B.jpg', UploadBase::OK,
  61                                 'upload title with slash' ],
  62                         /* A title with illegal char */
  63                         [ 'A:B.jpg', 'A-B.jpg', UploadBase::OK,
  64                                 'upload title with colon' ],
  65                         /* Stripping leading File: prefix */
  66                         [ 'File:C.jpg', 'C.jpg', UploadBase::OK,
  67                                 'upload title with File prefix' ],
  68                         /* Test illegal suggested title (r94601) */
  69                         [ '%281%29.JPG', null, UploadBase::ILLEGAL_FILENAME,
  70                                 'illegal title for upload' ],
  71                         /* A title without extension */
  72                         [ 'A', null, UploadBase::FILETYPE_MISSING,
  73                                 'upload title without extension' ],
  74                         /* A title with no basename */
  75                         [ '.jpg', null, UploadBase::MIN_LENGTH_PARTNAME,
  76                                 'upload title without basename' ],
  77                         /* A title that is longer than 255 bytes */
  78                         [ str_repeat( 'a', 255 ) . '.jpg', null, UploadBase::FILENAME_TOO_LONG,
  79                                 'upload title longer than 255 bytes' ],
  80                         /* A title that is longer than 240 bytes */
  81                         [ str_repeat( 'a', 240 ) . '.jpg', null, UploadBase::FILENAME_TOO_LONG,
  82                                 'upload title longer than 240 bytes' ],
  83                 ];
  84         }
  85
  86         /**
  87          * Test the upload verification functions
  88          * @covers \UploadBase::verifyUpload
  89          */
  90         public function testVerifyUpload() {
  91                 /* Setup with zero file size */
  92                 $this->upload->initializePathInfo( '', '', 0 );
  93                 $result = $this->upload->verifyUpload();
  94                 $this->assertEquals( UploadBase::EMPTY_FILE,
  95                         $result['status'],
  96                         'upload empty file' );
  97         }
  98
  99         // Helper used to create an empty file of size $size.
 100         private function createFileOfSize( $size ) {
 101                 $filename = $this->getNewTempFile();
 102
 103                 $fh = fopen( $filename, 'w' );
 104                 ftruncate( $fh, $size );
 105                 fclose( $fh );
 106
 107                 return $filename;
 108         }
 109
 110         /**
 111          * @covers \UploadBase::verifyUpload
 112          *
 113          * test uploading a 100 bytes file with $wgMaxUploadSize = 100
 114          *
 115          * This method should be abstracted so we can test different settings.
 116          */
 117         public function testMaxUploadSize() {
 118                 $this->overrideConfigValues( [
 119                         MainConfigNames::MaxUploadSize => 100,
 120                         MainConfigNames::FileExtensions => [
 121                                 'txt',
 122                         ],
 123                 ] );
 124
 125                 $filename = $this->createFileOfSize( 100 );
 126                 $this->upload->initializePathInfo( basename( $filename ) . '.txt', $filename, 100 );
 127                 $result = $this->upload->verifyUpload();
 128
 129                 $this->assertEquals(
 130                         [ 'status' => UploadBase::OK ],
 131                         $result
 132                 );
 133         }
 134
 135         /**
 136          * @covers \UploadBase::checkSvgScriptCallback
 137          * @dataProvider provideCheckSvgScriptCallback
 138          */
 139         public function testCheckSvgScriptCallback( $svg, $wellFormed, $filterMatch, $message ) {
 140                 [ $formed, $match ] = $this->upload->checkSvgString( $svg );
 141                 $this->assertSame( $wellFormed, $formed, $message . " (well-formed)" );
 142                 $this->assertSame( $filterMatch, $match, $message . " (filter match)" );
 143         }
 144
 145         public static function provideCheckSvgScriptCallback() {
 146                 return [
 147                         // html5sec SVG vectors
 148                         [
 149                                 '<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>',
 150                                 true, /* SVG is well formed */
 151                                 true, /* Evil SVG detected */
 152                                 'Script tag in svg (http://html5sec.org/#47)'
 153                         ],
 154                         [
 155                                 '<svg xmlns="http://www.w3.org/2000/svg"><g onload="javascript:alert(1)"></g></svg>',
 156                                 true,
 157                                 true,
 158                                 'SVG with onload property (http://html5sec.org/#11)'
 159                         ],
 160                         [
 161                                 '<svg onload="javascript:alert(1)" xmlns="http://www.w3.org/2000/svg"></svg>',
 162                                 true,
 163                                 true,
 164                                 'SVG with onload property (http://html5sec.org/#65)'
 165                         ],
 166                         [
 167                                 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:svg="http://www.w3.org/2000/svg" xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
 168    ><defs><inkscape:path-effect svg:onload="javascript:alert(1)" /></defs></svg>',
 169                                 true,
 170                                 true,
 171                                 'SVG with svg:onload on a non-svg element (probably not a thing)'
 172                         ],
 173                         [
 174                                 '<svg xmlns="http://www.w3.org/2000/svg"> <a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="javascript:alert(1)"><rect width="1000" height="1000" fill="white"/></a> </svg>',
 175                                 true,
 176                                 true,
 177                                 'SVG with javascript xlink (http://html5sec.org/#87)'
 178                         ],
 179                         [
 180                                 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><use xlink:href="data:application/xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9IjUwIiBjeD0iMTAwIiBjeT0iMTAwIiBzdHlsZT0iZmlsbDogI0YwMCI+CjxzZXQgYXR0cmlidXRlTmFtZT0iZmlsbCIgYXR0cmlidXRlVHlwZT0iQ1NTIiBvbmJlZ2luPSdhbGVydChkb2N1bWVudC5jb29raWUpJwpvbmVuZD0nYWxlcnQoIm9uZW5kIiknIHRvPSIjMDBGIiBiZWdpbj0iMXMiIGR1cj0iNXMiIC8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/> </svg>',
 181                                 true,
 182                                 true,
 183                                 'SVG with Opera image xlink (http://html5sec.org/#88 - c)'
 184                         ],
 185                         [
 186                                 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">  <animation xlink:href="javascript:alert(1)"/> </svg>',
 187                                 true,
 188                                 true,
 189                                 'SVG with Opera animation xlink (http://html5sec.org/#88 - a)'
 190                         ],
 191                         [
 192                                 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">  <animation xlink:href="data:text/xml,%3Csvg xmlns=\'http://www.w3.org/2000/svg\' onload=\'alert(1)\'%3E%3C/svg%3E"/> </svg>',
 193                                 true,
 194                                 true,
 195                                 'SVG with Opera animation xlink (http://html5sec.org/#88 - b)'
 196                         ],
 197                         [
 198                                 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">  <image xlink:href="data:image/svg+xml,%3Csvg xmlns=\'http://www.w3.org/2000/svg\' onload=\'alert(1)\'%3E%3C/svg%3E"/> </svg>',
 199                                 true,
 200                                 true,
 201                                 'SVG with Opera image xlink (http://html5sec.org/#88 - c)'
 202                         ],
 203                         [
 204                                 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">  <foreignObject xlink:href="javascript:alert(1)"/> </svg>',
 205                                 true,
 206                                 true,
 207                                 'SVG with Opera foreignObject xlink (http://html5sec.org/#88 - d)'
 208                         ],
 209                         [
 210                                 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">  <foreignObject xlink:href="data:text/xml,%3Cscript xmlns=\'http://www.w3.org/1999/xhtml\'%3Ealert(1)%3C/script%3E"/> </svg>',
 211                                 true,
 212                                 true,
 213                                 'SVG with Opera foreignObject xlink (http://html5sec.org/#88 - e)'
 214                         ],
 215                         [
 216                                 '<svg xmlns="http://www.w3.org/2000/svg"> <set attributeName="onmouseover" to="alert(1)"/> </svg>',
 217                                 true,
 218                                 true,
 219                                 'SVG with event handler set (http://html5sec.org/#89 - a)'
 220                         ],
 221                         [
 222                                 '<svg xmlns="http://www.w3.org/2000/svg"> <animate attributeName="onunload" to="alert(1)"/> </svg>',
 223                                 true,
 224                                 true,
 225                                 'SVG with event handler animate (http://html5sec.org/#89 - a)'
 226                         ],
 227                         [
 228                                 '<svg xmlns="http://www.w3.org/2000/svg"> <handler xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load">alert(1)</handler> </svg>',
 229                                 true,
 230                                 true,
 231                                 'SVG with element handler (http://html5sec.org/#94)'
 232                         ],
 233                         [
 234                                 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <feImage> <set attributeName="xlink:href" to="data:image/svg+xml;charset=utf-8;base64, PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxzY3JpcHQ%2BYWxlcnQoMSk8L3NjcmlwdD48L3N2Zz4NCg%3D%3D"/> </feImage> </svg>',
 235                                 true,
 236                                 true,
 237                                 'SVG with href to data: url (http://html5sec.org/#95)'
 238                         ],
 239                         [
 240                                 '<svg xmlns="http://www.w3.org/2000/svg" id="foo"> <x xmlns="http://www.w3.org/2001/xml-events" event="load" observer="foo" handler="data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%0A%3Chandler%20xml%3Aid%3D%22bar%22%20type%3D%22application%2Fecmascript%22%3E alert(1) %3C%2Fhandler%3E%0A%3C%2Fsvg%3E%0A#bar"/> </svg>',
 241                                 true,
 242                                 true,
 243                                 'SVG with Tiny handler (http://html5sec.org/#104)'
 244                         ],
 245                         [
 246                                 '<svg xmlns="http://www.w3.org/2000/svg"> <a id="x"><rect fill="white" width="1000" height="1000"/></a> <rect fill="white" style="clip-path:url(test3.svg#a);fill:url(#b);filter:url(#c);marker:url(#d);mask:url(#e);stroke:url(#f);"/> </svg>',
 247                                 true,
 248                                 true,
 249                                 'SVG with new CSS styles properties (http://html5sec.org/#109)'
 250                         ],
 251                         [
 252                                 '<svg xmlns="http://www.w3.org/2000/svg"> <a id="x"><rect fill="white" width="1000" height="1000"/></a> <rect clip-path="url(test3.svg#a)" /> </svg>',
 253                                 true,
 254                                 true,
 255                                 'SVG with new CSS styles properties as attributes'
 256                         ],
 257                         [
 258                                 '<svg xmlns="http://www.w3.org/2000/svg"> <a id="x"> <rect fill="white" width="1000" height="1000"/> </a> <rect fill="url(http://html5sec.org/test3.svg#a)" /> </svg>',
 259                                 true,
 260                                 true,
 261                                 'SVG with new CSS styles properties as attributes (2)'
 262                         ],
 263                         [
 264                                 '<svg xmlns="http://www.w3.org/2000/svg"> <path d="M0,0" style="marker-start:url(test4.svg#a)"/> </svg>',
 265                                 true,
 266                                 true,
 267                                 'SVG with path marker-start (http://html5sec.org/#110)'
 268                         ],
 269                         [
 270                                 '<?xml version="1.0"?> <?xml-stylesheet type="text/xml" href="#stylesheet"?> <!DOCTYPE doc [ <!ATTLIST xsl:stylesheet id ID #REQUIRED>]> <svg xmlns="http://www.w3.org/2000/svg"> <xsl:stylesheet id="stylesheet" version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> <xsl:template match="/"> <iframe xmlns="http://www.w3.org/1999/xhtml" src="javascript:alert(1)"></iframe> </xsl:template> </xsl:stylesheet> <circle fill="red" r="40"></circle> </svg>',
 271                                 false,
 272                                 true,
 273                                 'SVG with embedded stylesheet (http://html5sec.org/#125)'
 274                         ],
 275                         [
 276                                 '<?xml version="1.0"?> <?xml-stylesheet type="text/xml" href="#stylesheet"?> <svg xmlns="http://www.w3.org/2000/svg"> <xsl:stylesheet id="stylesheet" version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> <xsl:template match="/"> <iframe xmlns="http://www.w3.org/1999/xhtml" src="javascript:alert(1)"></iframe> </xsl:template> </xsl:stylesheet> <circle fill="red" r="40"></circle> </svg>',
 277                                 true,
 278                                 true,
 279                                 'SVG with embedded stylesheet no doctype'
 280                         ],
 281                         [
 282                                 '<svg xmlns="http://www.w3.org/2000/svg" id="x"> <listener event="load" handler="#y" xmlns="http://www.w3.org/2001/xml-events" observer="x"/> <handler id="y">alert(1)</handler> </svg>',
 283                                 true,
 284                                 true,
 285                                 'SVG with handler attribute (http://html5sec.org/#127)'
 286                         ],
 287                         [
 288                                 // Haven't found a browser that accepts this particular example, but we
 289                                 // don't want to allow embeded svgs, ever
 290                                 '<svg> <image style=\'filter:url("data:image/svg+xml;charset=utf-8;base64, PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxzY3JpcHQ/YWxlcnQoMSk8L3NjcmlwdD48L3N2Zz4NCg==")\' /> </svg>',
 291                                 true,
 292                                 true,
 293                                 'SVG with image filter via style (http://html5sec.org/#129)'
 294                         ],
 295                         [
 296                                 // This doesn't seem possible without embedding the svg, but just in case
 297                                 '<svg> <a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="?"> <circle r="400"></circle> <animate attributeName="xlink:href" begin="0" from="javascript:alert(1)" to="" /> </a></svg>',
 298                                 true,
 299                                 true,
 300                                 'SVG with animate from (http://html5sec.org/#137)'
 301                         ],
 302                         [
 303                                 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <a><text y="1em">Click me</text> <animate attributeName="xlink:href" values="javascript:alert(\'Bang!\')" begin="0s" dur="0.1s" fill="freeze" /> </a></svg>',
 304                                 true,
 305                                 true,
 306                                 'SVG with animate xlink:href (http://html5sec.org/#137)'
 307                         ],
 308                         [
 309                                 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:y="http://www.w3.org/1999/xlink"> <a y:href="#"> <text y="1em">Click me</text> <animate attributeName="y:href" values="javascript:alert(\'Bang!\')" begin="0s" dur="0.1s" fill="freeze" /> </a> </svg>',
 310                                 true,
 311                                 true,
 312                                 'SVG with animate y:href (http://html5sec.org/#137)'
 313                         ],
 314
 315                         // Other hostile SVG's
 316                         [
 317                                 '<?xml version="1.0" encoding="UTF-8" standalone="no"?> <svg xmlns:xlink="http://www.w3.org/1999/xlink"> <image xlink:href="https://upload.wikimedia.org/wikipedia/commons/3/34/Bahnstrecke_Zeitz-Camburg_1930.png" /> </svg>',
 318                                 true,
 319                                 true,
 320                                 'SVG with non-local image href (T67839)'
 321                         ],
 322                         [
 323                                 '<?xml version="1.0" ?> <?xml-stylesheet type="text/xsl" href="/w/index.php?title=User:Jeeves/test.xsl&amp;action=raw&amp;format=xml" ?> <svg> <height>50</height> <width>100</width> </svg>',
 324                                 true,
 325                                 true,
 326                                 'SVG with remote stylesheet (T59550)'
 327                         ],
 328                         [
 329                                 '<svg xmlns="http://www.w3.org/2000/svg" viewbox="-1 -1 15 15"> <rect y="0" height="13" width="12" stroke="#179" rx="1" fill="#2ac"/> <text x="1.5" y="11" font-family="courier" stroke="white" font-size="16"><![CDATA[B]]></text> <iframe xmlns="http://www.w3.org/1999/xhtml" srcdoc="&#x3C;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3E;&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x27;&#x58;&#x53;&#x53;&#x45;&#x44;&#x20;&#x3D;&#x3E;&#x20;&#x44;&#x6F;&#x6D;&#x61;&#x69;&#x6E;&#x28;&#x27;&#x2B;&#x74;&#x6F;&#x70;&#x2E;&#x64;&#x6F;&#x63;&#x75;&#x6D;&#x65;&#x6E;&#x74;&#x2E;&#x64;&#x6F;&#x6D;&#x61;&#x69;&#x6E;&#x2B;&#x27;&#x29;&#x27;&#x29;&#x3B;&#x3C;&#x2F;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3E;"></iframe> </svg>',
 330                                 true,
 331                                 true,
 332                                 'SVG with rembeded iframe (T62771)'
 333                         ],
 334                         [
 335                                 '<svg xmlns="http://www.w3.org/2000/svg" viewBox="6 3 177 153" xmlns:xlink="http://www.w3.org/1999/xlink"> <style>@import url("https://fonts.googleapis.com/css?family=Bitter:700&amp;text=WebPlatform.org");</style> <g transform="translate(-.5,-.5)"> <text fill="#474747" x="95" y="150" text-anchor="middle" font-family="Bitter" font-size="20" font-weight="bold">WebPlatform.org</text> </g> </svg>',
 336                                 true,
 337                                 true,
 338                                 'SVG with @import in style element (T71008)'
 339                         ],
 340                         [
 341                                 '<svg xmlns="http://www.w3.org/2000/svg" viewBox="6 3 177 153" xmlns:xlink="http://www.w3.org/1999/xlink"> <style>@import url("https://fonts.googleapis.com/css?family=Bitter:700&amp;text=WebPlatform.org");<foo/></style> <g transform="translate(-.5,-.5)"> <text fill="#474747" x="95" y="150" text-anchor="middle" font-family="Bitter" font-size="20" font-weight="bold">WebPlatform.org</text> </g> </svg>',
 342                                 true,
 343                                 true,
 344                                 'SVG with @import in style element and child element (T71008#c11)'
 345                         ],
 346                         [
 347                                 '<svg xmlns="http://www.w3.org/2000/svg" viewBox="6 3 177 153" xmlns:xlink="http://www.w3.org/1999/xlink"> <style>@imporT "https://fonts.googleapis.com/css?family=Bitter:700&amp;text=WebPlatform.org";</style> <g transform="translate(-.5,-.5)"> <text fill="#474747" x="95" y="150" text-anchor="middle" font-family="Bitter" font-size="20" font-weight="bold">WebPlatform.org</text> </g> </svg>',
 348                                 true,
 349                                 true,
 350                                 'SVG with case-insensitive @import in style element (bug T85349)'
 351                         ],
 352                         [
 353                                 '<svg xmlns="http://www.w3.org/2000/svg"> <rect width="100" height="100" style="background-image:url(https://www.google.com/images/srpr/logo11w.png)"/> </svg>',
 354                                 true,
 355                                 true,
 356                                 'SVG with remote background image (T71008)'
 357                         ],
 358                         [
 359                                 '<svg xmlns="http://www.w3.org/2000/svg"> <rect width="100" height="100" style="background-image:\55rl(https://www.google.com/images/srpr/logo11w.png)"/> </svg>',
 360                                 true,
 361                                 true,
 362                                 'SVG with remote background image, encoded (T71008)'
 363                         ],
 364                         [
 365                                 '<svg xmlns="http://www.w3.org/2000/svg"> <style> #a { background-image:\55rl(\'https://www.google.com/images/srpr/logo11w.png\'); } </style> <rect width="100" height="100" id="a"/> </svg>',
 366                                 true,
 367                                 true,
 368                                 'SVG with remote background image, in style element (T71008)'
 369                         ],
 370                         [
 371                                 // This currently doesn't seem to work in any browsers, but in case
 372                                 // https://www.w3.org/TR/css3-images/ is implemented for SVG files
 373                                 '<svg xmlns="http://www.w3.org/2000/svg"> <rect width="100" height="100" style="background-image:image(\'sprites.svg#xywh=40,0,20,20\')"/> </svg>',
 374                                 true,
 375                                 true,
 376                                 'SVG with remote background image using image() (T71008)'
 377                         ],
 378                         [
 379                                 // As reported by Cure53
 380                                 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <a xlink:href="data:text/html;charset=utf-8;base64, PHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pPC9zY3JpcHQ%2BDQo%3D"> <circle r="400" fill="red"></circle> </a> </svg>',
 381                                 true,
 382                                 true,
 383                                 'SVG with data:text/html link target (firefox only)'
 384                         ],
 385                         [
 386                                 '<?xml version="1.0" encoding="UTF-8" standalone="no"?> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" [ <!ENTITY lol "lol"> <!ENTITY lol2 "&#x3C;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3E;&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x27;&#x58;&#x53;&#x53;&#x45;&#x44;&#x20;&#x3D;&#x3E;&#x20;&#x27;&#x2B;&#x64;&#x6F;&#x63;&#x75;&#x6D;&#x65;&#x6E;&#x74;&#x2E;&#x64;&#x6F;&#x6D;&#x61;&#x69;&#x6E;&#x29;&#x3B;&#x3C;&#x2F;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3E;"> ]> <svg xmlns="http://www.w3.org/2000/svg" width="68" height="68" viewBox="-34 -34 68 68" version="1.1"> <circle cx="0" cy="0" r="24" fill="#c8c8c8"/> <text x="0" y="0" fill="black">&lol2;</text> </svg>',
 387                                 false,
 388                                 true,
 389                                 'SVG with encoded script tag in internal entity (reported by Beyond Security)'
 390                         ],
 391                         [
 392                                 '<?xml version="1.0"?> <!DOCTYPE svg [ <!ENTITY foo SYSTEM "file:///etc/passwd"> ]> <svg xmlns="http://www.w3.org/2000/svg" version="1.1"> <desc>&foo;</desc> <rect width="300" height="100" style="fill:rgb(0,0,255);stroke-width:1;stroke:rgb(0,0,2)" /> </svg>',
 393                                 false,
 394                                 false,
 395                                 'SVG with external entity'
 396                         ],
 397                         [
 398                                 // The base64 = <script>alert(1)</script>. If for some reason
 399                                 // entities actually do get loaded, this should trigger
 400                                 // filterMatch to be true. So this test verifies that we
 401                                 // are not loading external entities.
 402                                 '<?xml version="1.0"?> <!DOCTYPE svg [ <!ENTITY foo SYSTEM "data:text/plain;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pgo="> ]> <svg xmlns="http://www.w3.org/2000/svg" version="1.1"> <desc>&foo;</desc> <rect width="300" height="100" style="fill:rgb(0,0,255);stroke-width:1;stroke:rgb(0,0,2)" /> </svg>',
 403                                 false,
 404                                 false, /* False verifies entities aren't getting loaded */
 405                                 'SVG with data: uri external entity'
 406                         ],
 407                         [
 408                                 "<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\"> <g> <a xlink:href=\"javascript:alert('1&#10;https://google.com')\"> <rect width=\"300\" height=\"100\" style=\"fill:rgb(0,0,255);stroke-width:1;stroke:rgb(0,0,2)\" /> </a> </g> </svg>",
 409                                 true,
 410                                 true,
 411                                 'SVG with javascript <a> link with newline (T122653)'
 412                         ],
 413                         // Test good, but strange files that we want to allow
 414                         [
 415                                 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <g> <a xlink:href="http://en.wikipedia.org/wiki/Main_Page"> <path transform="translate(0,496)" id="path6706" d="m 112.09375,107.6875 -5.0625,3.625 -4.3125,5.03125 -0.46875,0.5 -4.09375,3.34375 -9.125,5.28125 -8.625,-3.375 z" style="fill:#cccccc;fill-opacity:1;stroke:#6e6e6e;stroke-width:0.69999999;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;display:inline" /> </a> </g> </svg>',
 416                                 true,
 417                                 false,
 418                                 'SVG with <a> link to a remote site'
 419                         ],
 420                         [
 421                                 '<svg> <defs> <filter id="filter6226" x="-0.93243687" width="2.8648737" y="-0.24250539" height="1.4850108"> <feGaussianBlur stdDeviation="3.2344681" id="feGaussianBlur6228" /> </filter> <clipPath id="clipPath2436"> <path d="M 0,0 L 0,0 L 0,0 L 0,0 z" id="path2438" /> </clipPath> </defs> <g clip-path="url(#clipPath2436)" id="g2460"> <text id="text2466"> <tspan>12345</tspan> </text> </g> <path style="fill:#346733;fill-rule:evenodd;stroke:#000000;stroke-width:1;stroke-linecap:round;stroke-linejoin:bevel;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:1, 1;stroke-dashoffset:0;filter:url(\'#filter6226\');fill-opacity:1;opacity:0.79807692" d="M 236.82371,332.63732 C 236.92217,332.63732 z" id="path5618" /> </svg>',
 422                                 true,
 423                                 false,
 424                                 'SVG with local urls, including filter: in style'
 425                         ],
 426                         [
 427                                 '<?xml version="1.0" encoding="UTF-8" standalone="no"?><!DOCTYPE x [<!ATTLIST image x:href CDATA "data:image/png,foo" onerror CDATA "alert(\'XSSED = \'+document.domain)" onload CDATA "alert(\'XSSED = \'+document.domain)"> ]> <svg xmlns:h="http://www.w3.org/1999/xhtml" xmlns:x="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg"> <image /> </svg>',
 428                                 false,
 429                                 false,
 430                                 'SVG with evil default attribute values'
 431                         ],
 432                         [
 433                                 '<?xml version="1.0" encoding="UTF-8" standalone="no"?><!DOCTYPE svg SYSTEM "data:application/xml-dtd;base64,PCFET0NUWVBFIHN2ZyBbPCFBVFRMSVNUIGltYWdlIHg6aHJlZiBDREFUQSAiZGF0YTppbWFnZS9wbmcsZm9vIiBvbmVycm9yIENEQVRBICJhbGVydCgnWFNTRUQgPSAnK2RvY3VtZW50LmRvbWFpbikiIG9ubG9hZCBDREFUQSAiYWxlcnQoJ1hTU0VEID0gJytkb2N1bWVudC5kb21haW4pIj4gXT4K"><svg xmlns:x="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg"> <image /> </svg>',
 434                                 true,
 435                                 true,
 436                                 'SVG with an evil external dtd'
 437                         ],
 438                         [
 439                                 '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE svg PUBLIC "-//FOO/bar" "http://example.com"><svg></svg>',
 440                                 true,
 441                                 true,
 442                                 'SVG with random public doctype'
 443                         ],
 444                         [
 445                                 '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE svg SYSTEM \'http://example.com/evil.dtd\' ><svg></svg>',
 446                                 true,
 447                                 true,
 448                                 'SVG with random SYSTEM doctype'
 449                         ],
 450                         [
 451                                 '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE svg [<!ENTITY % foo "bar" >] ><svg></svg>',
 452                                 false,
 453                                 false,
 454                                 'SVG with parameter entity'
 455                         ],
 456                         [
 457                                 '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE svg [<!ENTITY foo "bar%a;" ] ><svg></svg>',
 458                                 false,
 459                                 false,
 460                                 'SVG with entity referencing parameter entity'
 461                         ],
 462                         [
 463                                 '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE svg [<!ENTITY foo "bar0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"> ] ><svg></svg>',
 464                                 false,
 465                                 false,
 466                                 'SVG with long entity'
 467                         ],
 468                         [
 469                                 '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE svg [<!ENTITY  foo \'"Hi", said bob\'> ] ><svg><g>&foo;</g></svg>',
 470                                 true,
 471                                 false,
 472                                 'SVG with apostrophe quote entity'
 473                         ],
 474                         [
 475                                 '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE svg [<!ENTITY name "Bob"><!ENTITY  foo \'"Hi", said &name;.\'> ] ><svg><g>&foo;</g></svg>',
 476                                 false,
 477                                 false,
 478                                 'SVG with recursive entity',
 479                         ],
 480                         [
 481                                 '<?xml version="1.0" encoding="UTF-8" standalone="no"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.0//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd" [ <!ATTLIST svg xmlns:xlink CDATA #FIXED "http://www.w3.org/1999/xlink"> ]> <svg width="417pt" height="366pt"
 482  viewBox="0.00 0.00 417.00 366.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"></svg>',
 483                                 true, /* well-formed */
 484                                 false, /* filter-hit */
 485                                 'GraphViz-esque svg with #FIXED xlink ns (Should be allowed)'
 486                         ],
 487                         [
 488                                 '<?xml version="1.0" encoding="UTF-8" standalone="no"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.0//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd" [ <!ATTLIST svg xmlns:xlink CDATA #FIXED "http://www.w3.org/1999/xlink2"> ]> <svg width="417pt" height="366pt"
 489  viewBox="0.00 0.00 417.00 366.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"></svg>',
 490                                 false,
 491                                 false,
 492                                 'GraphViz ATLIST exception should match exactly'
 493                         ],
 494                         [
 495                                 '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" [ <!-- Comment-here --> <!ENTITY foo "#ff6666">]><svg xmlns="http://www.w3.org/2000/svg"></svg>',
 496                                 true,
 497                                 false,
 498                                 'DTD with comments (Should be allowed)'
 499                         ],
 500                         [
 501                                 '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" [ <!-- invalid--comment  --> <!ENTITY foo "#ff6666">]><svg xmlns="http://www.w3.org/2000/svg"></svg>',
 502                                 false,
 503                                 false,
 504                                 'DTD with invalid comment'
 505                         ],
 506                         [
 507                                 '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" [ <!-- invalid ---> <!ENTITY foo "#ff6666">]><svg xmlns="http://www.w3.org/2000/svg"></svg>',
 508                                 false,
 509                                 false,
 510                                 'DTD with invalid comment 2'
 511                         ],
 512                         [
 513                                 '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" [ <!ENTITY bar "&foo;"> <!ENTITY foo "#ff6666">]><svg xmlns="http://www.w3.org/2000/svg"></svg>',
 514                                 true,
 515                                 false,
 516                                 'DTD with aliased entities (Should be allowed)'
 517                         ],
 518                         [
 519                                 '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" [ <!ENTITY bar \'&foo;\'> <!ENTITY foo \'#ff6666\'>]><svg xmlns="http://www.w3.org/2000/svg"></svg>',
 520                                 true,
 521                                 false,
 522                                 'DTD with aliased entities apos (Should be allowed)'
 523                         ],
 524                         [
 525                                 '<svg xmlns="http://www.w3.org/2000/svg"><g filter="url( \'#foo\' )"></g></svg>',
 526                                 true,
 527                                 false,
 528                                 'SVG with local filter (T69044)'
 529                         ],
 530                         [
 531                                 '<svg xmlns="http://www.w3.org/2000/svg"><g filter="url( http://example.com/#foo )"></g></svg>',
 532                                 true,
 533                                 true,
 534                                 'SVG with non-local filter (T69044)'
 535                         ],
 536
 537                 ];
 538                 // phpcs:enable
 539         }
 540
 541         /**
 542          * @covers \UploadBase::detectScriptInSvg
 543          * @dataProvider provideDetectScriptInSvg
 544          */
 545         public function testDetectScriptInSvg( $svg, $expected, $message ) {
 546                 // This only checks some weird cases, most tests are in testCheckSvgScriptCallback() above
 547                 $result = $this->upload->detectScriptInSvg( $svg, false );
 548                 $this->assertSame( $expected, $result, $message );
 549         }
 550
 551         public static function provideDetectScriptInSvg() {
 552                 global $IP;
 553                 return [
 554                         [
 555                                 $IP . self::UPLOAD_PATH . "buggynamespace-original.svg",
 556                                 false,
 557                                 'SVG with a weird but valid namespace definition created by Adobe Illustrator'
 558                         ],
 559                         [
 560                                 $IP . self::UPLOAD_PATH . "buggynamespace-okay.svg",
 561                                 false,
 562                                 'SVG with a namespace definition created by Adobe Illustrator and mangled by Inkscape'
 563                         ],
 564                         [
 565                                 $IP . self::UPLOAD_PATH . "buggynamespace-okay2.svg",
 566                                 false,
 567                                 'SVG with a namespace definition created by Adobe Illustrator and mangled by Inkscape (twice)'
 568                         ],
 569                         [
 570                                 $IP . self::UPLOAD_PATH . "inkscape-only-selected.svg",
 571                                 false,
 572                                 'SVG with an inkscape only-selected attribute'
 573                         ],
 574                         [
 575                                 $IP . self::UPLOAD_PATH . "buggynamespace-bad.svg",
 576                                 [ 'uploadscriptednamespace', 'i' ],
 577                                 'SVG with a namespace definition using an undefined entity'
 578                         ],
 579                         [
 580                                 $IP . self::UPLOAD_PATH . "buggynamespace-evilhtml.svg",
 581                                 [ 'uploadscriptednamespace', 'http://www.w3.org/1999/xhtml' ],
 582                                 'SVG with an html namespace encoded as an entity'
 583                         ],
 584                 ];
 585         }
 586
 587         /**
 588          * @covers \UploadBase::checkXMLEncodingMissmatch
 589          * @dataProvider provideCheckXMLEncodingMissmatch
 590          */
 591         public function testCheckXMLEncodingMissmatch( $fileContents, $evil ) {
 592                 $filename = $this->getNewTempFile();
 593                 file_put_contents( $filename, $fileContents );
 594                 $this->assertSame( $evil, UploadBase::checkXMLEncodingMissmatch( $filename ) );
 595         }
 596
 597         public static function provideCheckXMLEncodingMissmatch() {
 598                 return [
 599                         [ '<?xml version="1.0" encoding="utf-7"?><svg></svg>', true ],
 600                         [ '<?xml version="1.0" encoding="utf-8"?><svg></svg>', false ],
 601                         [ '<?xml version="1.0" encoding="WINDOWS-1252"?><svg></svg>', false ],
 602                         [ '<?xml version="1.0" encoding="us-ascii"?><svg></svg>', false ],
 603                 ];
 604         }
 605
 606         /**
 607          * @covers \UploadBase::detectScript
 608          * @dataProvider provideDetectScript
 609          */
 610         public function testDetectScript( $filename, $mime, $extension, $expected, $message ) {
 611                 $result = $this->upload->detectScript( $filename, $mime, $extension );
 612                 $this->assertSame( $expected, $result, $message );
 613         }
 614
 615         public static function provideDetectScript() {
 616                 global $IP;
 617                 return [
 618                         [
 619                                 $IP . self::UPLOAD_PATH . "png-plain.png",
 620                                 'image/png',
 621                                 'png',
 622                                 false,
 623                                 'PNG with no suspicious things in it; should pass.'
 624                         ],
 625                         [
 626                                 $IP . self::UPLOAD_PATH . "png-embedded-breaks-ie5.png",
 627                                 'image/png',
 628                                 'png',
 629                                 true,
 630                                 'PNG with embedded data that IE5/6 interprets as HTML; should be rejected.'
 631                         ],
 632                         [
 633                                 $IP . self::UPLOAD_PATH . "jpeg-a-href-in-metadata.jpg",
 634                                 'image/jpeg',
 635                                 'jpeg',
 636                                 false,
 637                                 'JPEG with innocuous HTML in metadata from a flickr photo; should pass (T27707).',
 638                         ],
 639                 ];
 640         }
 641 }
 642
 643 class UploadTestHandler extends UploadBase {
 644         public function initializeFromRequest( &$request ) {
 645         }
 646
 647         public function testTitleValidation( $name ) {
 648                 $this->mTitle = false;
 649                 $this->mDesiredDestName = $name;
 650                 $this->mTitleError = UploadBase::OK;
 651                 $this->getTitle();
 652
 653                 return $this->mTitleError;
 654         }
 655
 656         /**
 657          * Almost the same as UploadBase::detectScriptInSvg, except it's
 658          * public, works on an xml string instead of filename, and returns
 659          * the result instead of interpreting them.
 660          * @param string $svg
 661          * @return array
 662          */
 663         public function checkSvgString( $svg ) {
 664                 $check = new XmlTypeCheck(
 665                         $svg,
 666                         [ $this, 'checkSvgScriptCallback' ],
 667                         false,
 668                         [
 669                                 'processing_instruction_handler' => [ UploadBase::class, 'checkSvgPICallback' ],
 670                                 'external_dtd_handler' => [ UploadBase::class, 'checkSvgExternalDTD' ],
 671                         ]
 672                 );
 673                 return [ $check->wellFormed, $check->filterMatch ];
 674         }
 675
 676         /**
 677          * Same as parent function, but override visibility to 'public'.
 678          * @inheritDoc
 679          */
 680         public function detectScriptInSvg( $filename, $partial ) {
 681                 return parent::detectScriptInSvg( $filename, $partial );
 682         }
 683 }