MAGETWO-95622: Path Validation in Templates

Author: zakdma

lib/internal/Magento/Framework/View/Element/Template/File/Validator.php

@@ -5,12 +5,12 @@
  */
 namespace Magento\Framework\View\Element\Template\File;
 
-use \Magento\Framework\App\Filesystem\DirectoryList;
+use Magento\Framework\App\Filesystem\DirectoryList;
 use Magento\Framework\Component\ComponentRegistrar;
+use Magento\Framework\Filesystem\Driver\File as FileDriver;
 
 /**
- * Class Validator
- * @package Magento\Framework\View\Element\Template\File
+ * Class Validator.
  */
 class Validator
 {
@@ -68,26 +68,34 @@ class Validator
      */
     protected $_compiledDir;
 
+    /**
+     * @var FileDriver
+     */
+    private $fileDriver;
+
     /**
      * Class constructor
      *
      * @param \Magento\Framework\Filesystem $filesystem
      * @param \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfigInterface
      * @param ComponentRegistrar $componentRegistrar
      * @param string|null $scope
+     * @param FileDriver|null $fileDriver
      */
     public function __construct(
         \Magento\Framework\Filesystem $filesystem,
         \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfigInterface,
         ComponentRegistrar $componentRegistrar,
-        $scope = null
+        $scope = null,
+        FileDriver $fileDriver = null
     ) {
         $this->_filesystem = $filesystem;
         $this->_isAllowSymlinks = $scopeConfigInterface->getValue(self::XML_PATH_TEMPLATE_ALLOW_SYMLINK, $scope);
         $this->_themesDir = $componentRegistrar->getPaths(ComponentRegistrar::THEME);
         $this->moduleDirs = $componentRegistrar->getPaths(ComponentRegistrar::MODULE);
         $this->_compiledDir = $this->_filesystem->getDirectoryRead(DirectoryList::TMP_MATERIALIZATION_DIR)
             ->getAbsolutePath();
+        $this->fileDriver = $fileDriver ?: \Magento\Framework\App\ObjectManager::getInstance()->get(FileDriver::class);
     }
 
     /**
@@ -128,7 +136,7 @@ protected function isPathInDirectories($path, $directories)
             $directories = (array)$directories;
         }
         foreach ($directories as $directory) {
-            if (0 === strpos($path, $directory)) {
+            if (0 === strpos($this->fileDriver->getRealPath($path), $directory)) {
                 return true;
             }
         }

lib/internal/Magento/Framework/View/Test/Unit/Element/Template/File/ValidatorTest.php

@@ -10,41 +10,40 @@
 use \Magento\Framework\Filesystem\DriverPool;
 
 /**
- * Class ValidatorTest
- * @package Magento\Framework\View\Test\Unit\Element\Template\File
+ * Tests for Magento\Framework\View\Element\Template\File\Validator class.
  */
 class ValidatorTest extends \PHPUnit\Framework\TestCase
 {
     /**
-     * Resolver object
+     * Resolver object.
      *
      * @var \Magento\Framework\View\Element\Template\File\Validator
      */
-    private $_validator;
+    private $validator;
 
     /**
-     * Mock for view file system
+     * Mock for view file system.
      *
      * @var \Magento\Framework\FileSystem|\PHPUnit_Framework_MockObject_MockObject
      */
-    private $_fileSystemMock;
+    private $fileSystemMock;
 
     /**
-     * Mock for scope config
+     * Mock for scope config.
      *
      * @var \Magento\Framework\App\Config\ScopeConfigInterface|\PHPUnit_Framework_MockObject_MockObject
      */
-    private $_scopeConfigMock;
+    private $scopeConfigMock;
 
     /**
-     * Mock for root directory reader
+     * Mock for root directory reader.
      *
      * @var \Magento\Framework\Filesystem\Directory\ReadInterface|\PHPUnit_Framework_MockObject_MockObject
      */
     private $rootDirectoryMock;
 
     /**
-     * Mock for compiled directory reader
+     * Mock for compiled directory reader.
      *
      * @var \Magento\Framework\Filesystem\Directory\ReadInterface|\PHPUnit_Framework_MockObject_MockObject
      */
@@ -56,18 +55,16 @@ class ValidatorTest extends \PHPUnit\Framework\TestCase
     private $componentRegistrar;
 
     /**
-     * Test Setup
-     *
-     * @return void
+     * @inheritdoc
      */
     protected function setUp()
     {
-        $this->_fileSystemMock = $this->createMock(\Magento\Framework\Filesystem::class);
-        $this->_scopeConfigMock = $this->createMock(\Magento\Framework\App\Config\ScopeConfigInterface::class);
+        $this->fileSystemMock = $this->createMock(\Magento\Framework\Filesystem::class);
+        $this->scopeConfigMock = $this->createMock(\Magento\Framework\App\Config\ScopeConfigInterface::class);
         $this->rootDirectoryMock = $this->createMock(\Magento\Framework\Filesystem\Directory\ReadInterface::class);
         $this->compiledDirectoryMock = $this->createMock(\Magento\Framework\Filesystem\Directory\ReadInterface::class);
 
-        $this->_fileSystemMock->expects($this->any())
+        $this->fileSystemMock->expects($this->any())
             ->method('getDirectoryRead')
             ->will($this->returnValueMap(
                 [
@@ -87,39 +84,46 @@ protected function setUp()
                 $this->returnValueMap(
                     [
                         [ComponentRegistrar::MODULE, ['/magento/app/code/Some/Module']],
-                        [ComponentRegistrar::THEME, ['/magento/themes/default']]
+                        [ComponentRegistrar::THEME, ['/magento/themes/default']],
                     ]
                 )
             );
-        $this->_validator = new \Magento\Framework\View\Element\Template\File\Validator(
-            $this->_fileSystemMock,
-            $this->_scopeConfigMock,
-            $this->componentRegistrar
+
+        $fileDriverMock = $this->createMock(\Magento\Framework\Filesystem\Driver\File::class);
+        $fileDriverMock->expects($this->any())
+            ->method('getRealPath')
+            ->willReturnArgument(0);
+
+        $this->validator = new \Magento\Framework\View\Element\Template\File\Validator(
+            $this->fileSystemMock,
+            $this->scopeConfigMock,
+            $this->componentRegistrar,
+            null,
+            $fileDriverMock
         );
     }
 
     /**
-     * Test is file valid
+     * Test is file valid.
      *
      * @param string $file
      * @param bool $expectedResult
-     *
-     * @dataProvider testIsValidDataProvider
-     *
      * @return void
+     *
+     * @dataProvider isValidDataProvider
      */
-    public function testIsValid($file, $expectedResult)
+    public function testIsValid(string $file, bool $expectedResult)
     {
         $this->rootDirectoryMock->expects($this->any())->method('isFile')->will($this->returnValue(true));
-        $this->assertEquals($expectedResult, $this->_validator->isValid($file));
+        $this->assertEquals($expectedResult, $this->validator->isValid($file));
     }
 
     /**
-     * Data provider for testIsValid
+     * Data provider for testIsValid.
      *
-     * @return []
+     * @return array
      */
-    public function testIsValidDataProvider()
+    public function isValidDataProvider() : array
     {
         return [
             'empty' => ['', false],