Merge remote-tracking branch 'obsessive-owls/MAGETWO-95636' into 2.3.0-qwerty-bugs1

Author: cpartica

app/code/Magento/CatalogImportExport/Model/Import/Uploader.php

@@ -101,7 +101,7 @@ class Uploader extends \Magento\MediaStorage\Model\File\Uploader
      * @param \Magento\MediaStorage\Model\File\Validator\NotProtectedExtension $validator
      * @param \Magento\Framework\Filesystem $filesystem
      * @param \Magento\Framework\Filesystem\File\ReadFactory $readFactory
-     * @param null $filePath
+     * @param string|null $filePath
      * @throws \Magento\Framework\Exception\LocalizedException
      */
     public function __construct(
@@ -146,20 +146,25 @@ public function init()
      * @param string $fileName
      * @param bool $renameFileOff
      * @return array
+     *
+     * @throws \Magento\Framework\Exception\LocalizedException
      */
     public function move($fileName, $renameFileOff = false)
     {
         if ($renameFileOff) {
             $this->setAllowRenameFiles(false);
         }
+
+        if ($this->getTmpDir()) {
+            $filePath = $this->getTmpDir() . '/';
+        } else {
+            $filePath = '';
+        }
+
         if (preg_match('/\bhttps?:\/\//i', $fileName, $matches)) {
             $url = str_replace($matches[0], '', $fileName);
-
-            if ($matches[0] === $this->httpScheme) {
-                $read = $this->_readFactory->create($url, DriverPool::HTTP);
-            } else {
-                $read = $this->_readFactory->create($url, DriverPool::HTTPS);
-            }
+            $driver = $matches[0] === $this->httpScheme ? DriverPool::HTTP : DriverPool::HTTPS;
+            $read = $this->_readFactory->create($url, $driver);
 
             //only use filename (for URI with query parameters)
             $parsedUrlPath = parse_url($url, PHP_URL_PATH);
@@ -170,11 +175,11 @@ public function move($fileName, $renameFileOff = false)
                 }
             }
 
-            if ($this->getTmpDir()) {
-                $filePath = $this->getTmpDir() . '/';
-            } else {
-                $filePath = '';
+            $fileExtension = pathinfo($fileName, PATHINFO_EXTENSION);
+            if ($fileExtension && !$this->checkAllowedExtension($fileExtension)) {
+                throw new \Magento\Framework\Exception\LocalizedException(__('Disallowed file type.'));
             }
+
             $fileName = preg_replace('/[^a-z0-9\._-]+/i', '', $fileName);
             $filePath = $this->_directory->getRelativePath($filePath . $fileName);
             $this->_directory->writeFile(
@@ -183,11 +188,6 @@ public function move($fileName, $renameFileOff = false)
             );
         }
 
-        if ($this->getTmpDir()) {
-            $filePath = $this->getTmpDir() . '/';
-        } else {
-            $filePath = '';
-        }
         $filePath = $this->_directory->getRelativePath($filePath . $fileName);
         $this->_setUploadFile($filePath);
         $destDir = $this->_directory->getAbsolutePath($this->getDestDir());
@@ -353,7 +353,7 @@ protected function _moveFile($tmpPath, $destPath)
     }
 
     /**
-     * {@inheritdoc}
+     * @inheritdoc
      */
     protected function chmod($file)
     {

app/code/Magento/CatalogImportExport/Test/Unit/Model/Import/UploaderTest.php

@@ -93,14 +93,14 @@ protected function setUp()
                 $this->filesystem,
                 $this->readFactory,
             ])
-            ->setMethods(['_setUploadFile', 'save', 'getTmpDir'])
+            ->setMethods(['_setUploadFile', 'save', 'getTmpDir', 'checkAllowedExtension'])
             ->getMock();
     }
 
     /**
      * @dataProvider moveFileUrlDataProvider
      */
-    public function testMoveFileUrl($fileUrl, $expectedHost, $expectedFileName)
+    public function testMoveFileUrl($fileUrl, $expectedHost, $expectedFileName, $checkAllowedExtension)
     {
         $destDir = 'var/dest/dir';
         $expectedRelativeFilePath = $expectedFileName;
@@ -128,6 +128,9 @@ public function testMoveFileUrl($fileUrl, $expectedHost, $expectedFileName)
         $this->uploader->expects($this->once())->method('_setUploadFile')->will($this->returnSelf());
         $this->uploader->expects($this->once())->method('save')->with($destDir . '/' . $expectedFileName)
             ->willReturn(['name' => $expectedFileName, 'path' => 'absPath']);
+        $this->uploader->expects($this->exactly($checkAllowedExtension))
+            ->method('checkAllowedExtension')
+            ->willReturn(true);
 
         $this->uploader->setDestDir($destDir);
         $result = $this->uploader->move($fileUrl);
@@ -224,31 +227,37 @@ public function moveFileUrlDataProvider()
                 '$fileUrl' => 'http://test_uploader_file',
                 '$expectedHost' => 'test_uploader_file',
                 '$expectedFileName' => 'test_uploader_file',
+                '$checkAllowedExtension' => 0
             ],
             [
                 '$fileUrl' => 'https://!:^&`;file',
                 '$expectedHost' => '!:^&`;file',
                 '$expectedFileName' => 'file',
+                '$checkAllowedExtension' => 0
             ],
             [
                 '$fileUrl' => 'https://www.google.com/image.jpg',
                 '$expectedHost' => 'www.google.com/image.jpg',
                 '$expectedFileName' => 'image.jpg',
+                '$checkAllowedExtension' => 1
             ],
             [
                 '$fileUrl' => 'https://www.google.com/image.jpg?param=1',
                 '$expectedHost' => 'www.google.com/image.jpg?param=1',
                 '$expectedFileName' => 'image.jpg',
+                '$checkAllowedExtension' => 1
             ],
             [
                 '$fileUrl' => 'https://www.google.com/image.jpg?param=1&param=2',
                 '$expectedHost' => 'www.google.com/image.jpg?param=1&param=2',
                 '$expectedFileName' => 'image.jpg',
+                '$checkAllowedExtension' => 1
             ],
             [
                 '$fileUrl' => 'http://www.google.com/image.jpg?param=1&param=2',
                 '$expectedHost' => 'www.google.com/image.jpg?param=1&param=2',
                 '$expectedFileName' => 'image.jpg',
+                '$checkAllowedExtension' => 1
             ],
         ];
     }