diff --git a/.gitignore b/.gitignore index cab673f32..2f8f9d007 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ composer.lock composer.phar vendor/ Tests/Functional/app/web/media/cache +.idea/ diff --git a/Binary/Loader/FileSystemLoader.php b/Binary/Loader/FileSystemLoader.php index b68079797..321925285 100644 --- a/Binary/Loader/FileSystemLoader.php +++ b/Binary/Loader/FileSystemLoader.php @@ -2,6 +2,7 @@ namespace Liip\ImagineBundle\Binary\Loader; +use Liip\ImagineBundle\Exception\InvalidArgumentException; use Liip\ImagineBundle\Model\FileBinary; use Symfony\Component\HttpFoundation\File\MimeType\ExtensionGuesserInterface; use Symfony\Component\HttpFoundation\File\MimeType\MimeTypeGuesserInterface; @@ -37,7 +38,11 @@ public function __construct( $this->mimeTypeGuesser = $mimeTypeGuesser; $this->extensionGuesser = $extensionGuesser; - $this->rootPath = rtrim($rootPath, '/'); + if (!($realRootPath = realpath($rootPath))) { + throw new InvalidArgumentException(sprintf('Root image path not resolvable "%s"', $rootPath)); + } + + $this->rootPath = $realRootPath; } /** @@ -45,11 +50,13 @@ public function __construct( */ public function find($path) { - if (false !== strpos($path, '../')) { - throw new NotLoadableException(sprintf("Source image was searched with '%s' out side of the defined root path", $path)); + if (!($absolutePath = realpath($this->rootPath.DIRECTORY_SEPARATOR.ltrim($path, DIRECTORY_SEPARATOR)))) { + throw new NotLoadableException(sprintf('Source image not resolvable "%s"', $path)); } - $absolutePath = $this->rootPath.'/'.ltrim($path, '/'); + if (0 !== strpos($absolutePath, $this->rootPath)) { + throw new NotLoadableException(sprintf('Source image invalid "%s" as it is outside of the defined root path', $absolutePath)); + } if (false == file_exists($absolutePath)) { throw new NotLoadableException(sprintf('Source image not found in "%s"', $absolutePath)); diff --git a/Exception/InvalidArgumentException.php b/Exception/InvalidArgumentException.php new file mode 100644 index 000000000..5116d87d6 --- /dev/null +++ b/Exception/InvalidArgumentException.php @@ -0,0 +1,7 @@ +setExpectedException( + 'Liip\ImagineBundle\Exception\InvalidArgumentException', + 'Root image path not resolvable' + ); + + new FileSystemLoader( + MimeTypeGuesser::getInstance(), + ExtensionGuesser::getInstance(), + '/a/bad/root/path' + ); + } + + public function testThrowExceptionIfRealPathIsOutsideRootPath1() { $loader = new FileSystemLoader( MimeTypeGuesser::getInstance(), @@ -51,13 +65,13 @@ public function testThrowExceptionIfPathHasDoublePointSlashAtBegging() $this->setExpectedException( 'Liip\ImagineBundle\Exception\Binary\Loader\NotLoadableException', - 'Source image was searched with' + 'Source image invalid' ); - $loader->find('../foo/bar'); + $loader->find('../Loader/../../Binary/Loader/../../../Resources/config/routing.xml'); } - public function testThrowExceptionIfPathHasDoublePointSlashInTheMiddle() + public function testThrowExceptionIfRealPathIsOutsideRootPath2() { $loader = new FileSystemLoader( MimeTypeGuesser::getInstance(), @@ -67,10 +81,21 @@ public function testThrowExceptionIfPathHasDoublePointSlashInTheMiddle() $this->setExpectedException( 'Liip\ImagineBundle\Exception\Binary\Loader\NotLoadableException', - 'Source image was searched with' + 'Source image invalid' + ); + + $loader->find('../../Binary/'); + } + + public function testThrowExceptionIfPathHasDoublePointSlashInTheMiddle() + { + $loader = new FileSystemLoader( + MimeTypeGuesser::getInstance(), + ExtensionGuesser::getInstance(), + __DIR__ ); - $loader->find('foo/../bar'); + $loader->find('/../../Binary/Loader/'.pathinfo(__FILE__, PATHINFO_BASENAME)); } public function testThrowExceptionIfFileNotExist() @@ -83,7 +108,7 @@ public function testThrowExceptionIfFileNotExist() $this->setExpectedException( 'Liip\ImagineBundle\Exception\Binary\Loader\NotLoadableException', - 'Source image not found' + 'Source image not resolvable' ); $loader->find('fileNotExist');