Merge branch 'MAGETWO-75418' into 2.3-develop-pr2

Author: OlgaVasyltsun

app/code/Magento/Cms/Helper/Wysiwyg/Images.php

@@ -8,7 +8,9 @@
 use Magento\Framework\App\Filesystem\DirectoryList;
 
 /**
- * Wysiwyg Images Helper
+ * Wysiwyg Images Helper.
+ *
+ * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
  */
 class Images extends \Magento\Framework\App\Helper\AbstractHelper
 {
@@ -156,17 +158,23 @@ public function convertPathToId($path)
     }
 
     /**
-     * Decode HTML element id
+     * Decode HTML element id.
      *
      * @param string $id
      * @return string
+     * @throws \InvalidArgumentException When path contains restricted symbols.
      */
     public function convertIdToPath($id)
     {
         if ($id === \Magento\Theme\Helper\Storage::NODE_ROOT) {
             return $this->getStorageRoot();
         } else {
-            return $this->getStorageRoot() . $this->idDecode($id);
+            $path = $this->getStorageRoot() . $this->idDecode($id);
+            if (preg_match('/\.\.(\\\|\/)/', $path)) {
+                throw new \InvalidArgumentException('Path is invalid');
+            }
+
+            return $path;
         }
     }
 

app/code/Magento/Cms/Test/Unit/Helper/Wysiwyg/ImagesTest.php

@@ -110,7 +110,7 @@ protected function setUp()
             ->willReturnMap(
                 [
                     [WysiwygConfig::IMAGE_DIRECTORY, null, $this->getAbsolutePath(WysiwygConfig::IMAGE_DIRECTORY)],
-                    [null, null, $this->getAbsolutePath(null)]
+                    [null, null, $this->getAbsolutePath(null)],
                 ]
             );
 
@@ -124,7 +124,7 @@ protected function setUp()
                 [
                     'clearWebsiteCache', 'getDefaultStoreView', 'getGroup', 'getGroups',
                     'getStore', 'getStores', 'getWebsite', 'getWebsites', 'hasSingleStore',
-                    'isSingleStoreMode', 'reinitStores', 'setCurrentStore', 'setIsSingleStoreModeAllowed'
+                    'isSingleStoreMode', 'reinitStores', 'setCurrentStore', 'setIsSingleStoreModeAllowed',
                 ]
             )
             ->disableOriginalConstructor()
@@ -229,7 +229,7 @@ public function providerConvertIdToPath()
     {
         return [
             ['', ''],
-            ['/test_path', 'L3Rlc3RfcGF0aA--']
+            ['/test_path', 'L3Rlc3RfcGF0aA--'],
         ];
     }
 
@@ -239,6 +239,15 @@ public function testConvertIdToPathNodeRoot()
         $this->assertEquals($this->imagesHelper->getStorageRoot(), $this->imagesHelper->convertIdToPath($pathId));
     }
 
+    /**
+     * @expectedException \InvalidArgumentException
+     * @expectedExceptionMessage Path is invalid
+     */
+    public function testConvertIdToPathInvalid()
+    {
+        $this->imagesHelper->convertIdToPath('Ly4uLy4uLy4uLy4uLy4uL3dvcms-');
+    }
+
     /**
      * @param string $fileName
      * @param int $maxLength
@@ -258,7 +267,7 @@ public function providerShortFilename()
         return [
             ['test', 3, 'tes...'],
             ['test', 4, 'test'],
-            ['test', 20, 'test']
+            ['test', 20, 'test'],
         ];
     }
 
@@ -280,7 +289,7 @@ public function providerShortFilenameDefaultMaxLength()
         return [
             ['Mini text', 'Mini text'],
             ['20 symbols are here', '20 symbols are here'],
-            ['Some text for this unit test', 'Some text for this u...']
+            ['Some text for this unit test', 'Some text for this u...'],
         ];
     }
 
@@ -319,7 +328,7 @@ public function providerIsUsingStaticUrlsAllowed()
     {
         return [
             [true],
-            [false]
+            [false],
         ];
     }
 
@@ -346,7 +355,7 @@ public function testGetCurrentPath($pathId, $expectedPath, $isExist)
                 [
                     ['/../wysiwyg/test_path', true],
                     ['/../wysiwyg/my.jpg', false],
-                    ['/../wysiwyg', true]
+                    ['/../wysiwyg', true],
                 ]
             );
         $this->directoryWriteMock->expects($this->any())
@@ -397,7 +406,7 @@ public function providerGetCurrentPath()
             [null, 'PATH/wysiwyg', true],
             ['L3Rlc3RfcGF0aA--', 'PATH/wysiwyg/test_path', false],
             ['L215LmpwZw--', 'PATH/wysiwyg', false],
-            [null, 'PATH/wysiwyg', false]
+            [null, 'PATH/wysiwyg', false],
         ];
     }
 
@@ -450,15 +459,15 @@ public function providerGetImageHtmlDeclarationRenderingAsTag()
                 'test.png',
                 true,
                 null,
-                '<img src="http://localhost/test.png" alt="" />'
+                '<img src="http://localhost/test.png" alt="" />',
             ],
             [
                 'http://localhost',
                 'test.png',
                 false,
                 '{{media url=&quot;/test.png&quot;}}',
-                '<img src="{{media url=&quot;/test.png&quot;}}" alt="" />'
-            ]
+                '<img src="{{media url=&quot;/test.png&quot;}}" alt="" />',
+            ],
         ];
     }
 
@@ -492,7 +501,7 @@ public function providerGetImageHtmlDeclaration()
     {
         return [
             ['http://localhost', 'test.png', true, 'http://localhost/test.png'],
-            ['http://localhost', 'test.png', false, '{{media url="/test.png"}}']
+            ['http://localhost', 'test.png', false, '{{media url="/test.png"}}'],
         ];
     }