feat: media upload by URL and base64 with whitelist and size limit

MediaImporter streams URL imports via wp_safe_remote_get with limit_response_size, checks Content-Length, intersects the MIME whitelist with get_allowed_mime_types and validates real content; base64 is size-checked before decoding. Server-side failures are write_failed; a failed alt text deletes the new attachment again (or partial_write). MediaUploads is the shared permission/result helper of both upload abilities. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 02:37:43 +02:00
parent f027da1785
commit 2e29a6cd4d
9 changed files with 1086 additions and 4 deletions
@@ -0,0 +1,302 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Integrations\Media;
+
+use Brain\Monkey\Functions;
+use LIT\MCP\Abilities\WriteFailed;
+use LIT\MCP\Integrations\Media\MediaImporter;
+use LIT\MCP\Limits;
+use LIT\MCP\Tests\Unit\TestCase;
+use Mockery;
+use WP_Error;
+
+final class MediaImporterTest extends TestCase
+{
+    /** @var list<string> */
+    private array $tempFiles = [];
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Functions\when('get_option')->justReturn(['upload_mb' => 1]);
+        Functions\when('wp_tempnam')->alias(function (): string {
+            $file = (string) tempnam(sys_get_temp_dir(), 'lit-up');
+            $this->tempFiles[] = $file;
+            return $file;
+        });
+        Functions\when('wp_delete_file')->alias(static function (string $file): void {
+            if (is_file($file)) {
+                unlink($file);
+            }
+        });
+        Functions\when('sanitize_file_name')->returnArg();
+        Functions\when('wp_basename')->alias('basename');
+        Functions\when('wp_parse_url')->alias('parse_url');
+        Functions\when('get_allowed_mime_types')->justReturn(MediaImporter::MIMES);
+    }
+
+    protected function tearDown(): void
+    {
+        foreach ($this->tempFiles as $file) {
+            if (is_file($file)) {
+                unlink($file);
+            }
+        }
+        parent::tearDown();
+    }
+
+    private function importer(): MediaImporter
+    {
+        return new MediaImporter(new Limits());
+    }
+
+    private function assertTempFilesRemoved(): void
+    {
+        foreach ($this->tempFiles as $file) {
+            self::assertFileDoesNotExist($file);
+        }
+    }
+
+    /** Lets the next wp_safe_remote_get write $body into the stream target and answer with $headers. */
+    private function respond(string $body, int $code = 200, array $headers = []): void
+    {
+        Functions\when('wp_safe_remote_get')->alias(static function (string $url, array $args) use ($body, $code, $headers): array {
+            file_put_contents($args['filename'], $body);
+            return ['response' => ['code' => $code], 'headers' => $headers, 'filename' => $args['filename']];
+        });
+        $this->responseReaders();
+    }
+
+    private function responseReaders(): void
+    {
+        Functions\when('wp_http_validate_url')->returnArg();
+        Functions\when('wp_remote_retrieve_response_code')->alias(static fn (array $r): int => $r['response']['code']);
+        Functions\when('wp_remote_retrieve_header')->alias(
+            static fn (array $r, string $name): string => (string) ($r['headers'][$name] ?? '')
+        );
+    }
+
+    public function testBase64UploadIsSideloadedWithAltText(): void
+    {
+        Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
+        Functions\expect('media_handle_sideload')->once()
+            ->with(Mockery::on(static fn (array $file): bool => $file['name'] === 'logo.png' && is_file($file['tmp_name'])), 5, 'Logo')
+            ->andReturnUsing(static function (array $file): int {
+                unlink($file['tmp_name']); // WordPress moves the temp file into uploads.
+                return 55;
+            });
+        Functions\expect('update_post_meta')->once()->with(55, '_wp_attachment_image_alt', 'Firmenlogo')->andReturn(true);
+
+        $id = $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', [
+            'title' => 'Logo',
+            'alt' => 'Firmenlogo',
+            'post_id' => 5,
+        ]);
+
+        self::assertSame(55, $id);
+    }
+
+    public function testOversizedBase64IsRejectedBeforeDecoding(): void
+    {
+        $result = $this->importer()->fromBase64(str_repeat('A', 2 * 1024 * 1024), 'big.png', []);
+
+        self::assertSame('lit_validation_failed', $result->get_error_code());
+        self::assertStringContainsString('Limit 1 MB', $result->get_error_message());
+        self::assertSame([], $this->tempFiles, 'no temp file may be written for an oversized upload');
+    }
+
+    public function testInvalidBase64IsRejected(): void
+    {
+        $result = $this->importer()->fromBase64('***', 'x.png', []);
+
+        self::assertSame('lit_validation_failed', $result->get_error_code());
+        self::assertSame([], $this->tempFiles);
+    }
+
+    public function testDisguisedFileIsRejectedAndTheTempFileRemoved(): void
+    {
+        Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => false, 'type' => false, 'proper_filename' => false]);
+        Functions\expect('media_handle_sideload')->never();
+
+        $result = $this->importer()->fromBase64(base64_encode('<?php evil();'), 'bild.png', []);
+
+        self::assertSame('lit_validation_failed', $result->get_error_code());
+        self::assertNotSame([], $this->tempFiles);
+        $this->assertTempFilesRemoved();
+    }
+
+    public function testTheWhitelistOnlyKeepsTypesWordPressAllowsTheUser(): void
+    {
+        Functions\when('get_allowed_mime_types')->justReturn(['png' => 'image/png', 'svg' => 'image/svg+xml']);
+        Functions\expect('wp_check_filetype_and_ext')->once()
+            ->with(Mockery::type('string'), 'logo.png', ['png' => 'image/png'])
+            ->andReturn(['ext' => false, 'type' => false, 'proper_filename' => false]);
+
+        $result = $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', []);
+
+        self::assertSame('lit_validation_failed', $result->get_error_code());
+        self::assertStringContainsString('png', $result->get_error_message());
+    }
+
+    public function testSideloadFailureIsAWriteFailureAndCleansUp(): void
+    {
+        Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
+        Functions\when('media_handle_sideload')->justReturn(new WP_Error('upload_error', 'Verzeichnis nicht beschreibbar'));
+
+        $result = $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', []);
+
+        self::assertSame('lit_write_failed', $result->get_error_code());
+        self::assertStringContainsString('Verzeichnis nicht beschreibbar', $result->get_error_message());
+        $this->assertTempFilesRemoved();
+    }
+
+    public function testFailedAltTextDeletesTheNewAttachmentAgain(): void
+    {
+        Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
+        Functions\when('media_handle_sideload')->justReturn(55);
+        Functions\when('update_post_meta')->justReturn(false);
+        Functions\when('get_post_meta')->justReturn('');
+        Functions\expect('wp_delete_attachment')->once()->with(55, true)->andReturn(new \stdClass());
+
+        try {
+            $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', ['alt' => 'Logo']);
+            self::fail('WriteFailed expected');
+        } catch (WriteFailed $e) {
+            self::assertTrue($e->rolledBack);
+            self::assertSame('lit_write_failed', $e->toError()->get_error_code());
+        }
+        $this->assertTempFilesRemoved();
+    }
+
+    public function testAltTextFailureWithoutRollbackIsAPartialWriteNamingTheAttachment(): void
+    {
+        Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
+        Functions\when('media_handle_sideload')->justReturn(55);
+        Functions\when('update_post_meta')->justReturn(false);
+        Functions\when('get_post_meta')->justReturn('');
+        Functions\when('wp_delete_attachment')->justReturn(false);
+
+        try {
+            $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', ['alt' => 'Logo']);
+            self::fail('WriteFailed expected');
+        } catch (WriteFailed $e) {
+            self::assertFalse($e->rolledBack);
+            self::assertSame(55, $e->postId);
+            $error = $e->toError();
+            self::assertSame('lit_partial_write', $error->get_error_code());
+            self::assertStringContainsString('Medium 55', $error->get_error_message());
+            self::assertSame(55, $error->get_error_data()['attachment_id']);
+        }
+    }
+
+    public function testAnAltTextAlreadyTakenFromTheImageIsNoFailure(): void
+    {
+        Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
+        Functions\when('media_handle_sideload')->justReturn(55);
+        Functions\when('update_post_meta')->justReturn(false); // Same value already stored (IPTC alt).
+        Functions\when('get_post_meta')->justReturn('Logo');
+        Functions\expect('wp_delete_attachment')->never();
+
+        self::assertSame(55, $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', ['alt' => 'Logo']));
+    }
+
+    public function testInternalUrlsAreRejectedWithoutRequest(): void
+    {
+        Functions\when('wp_http_validate_url')->justReturn(false);
+        Functions\expect('wp_safe_remote_get')->never();
+
+        $result = $this->importer()->fromUrl('http://127.0.0.1/wp-config.php', null, []);
+
+        self::assertSame('lit_validation_failed', $result->get_error_code());
+    }
+
+    public function testOnlyHttpUrlsAreFetched(): void
+    {
+        Functions\when('wp_http_validate_url')->returnArg();
+        Functions\expect('wp_safe_remote_get')->never();
+
+        $result = $this->importer()->fromUrl('ftp://example.com/logo.png', null, []);
+
+        self::assertSame('lit_validation_failed', $result->get_error_code());
+    }
+
+    public function testUrlImportDownloadsSafelyWithTheSizeLimit(): void
+    {
+        $this->responseReaders();
+        Functions\expect('wp_safe_remote_get')->once()->with(
+            'https://example.com/bilder/logo.png',
+            Mockery::on(static function (array $args): bool {
+                file_put_contents($args['filename'], 'PNGDATA');
+                return $args['stream'] === true && $args['limit_response_size'] === 1024 * 1024 + 1;
+            })
+        )->andReturn(['response' => ['code' => 200], 'headers' => []]);
+        Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
+        Functions\expect('media_handle_sideload')->once()
+            ->with(Mockery::on(static fn (array $file): bool => $file['name'] === 'logo.png'), 0, null)
+            ->andReturn(56);
+
+        self::assertSame(56, $this->importer()->fromUrl('https://example.com/bilder/logo.png', null, []));
+        $this->assertTempFilesRemoved();
+    }
+
+    public function testAMissingExtensionIsTakenFromTheContentType(): void
+    {
+        $this->respond('PNGDATA', 200, ['content-type' => 'image/png; charset=binary']);
+        Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
+        Functions\expect('media_handle_sideload')->once()
+            ->with(Mockery::on(static fn (array $file): bool => $file['name'] === 'foto.png'), 0, null)
+            ->andReturn(57);
+
+        self::assertSame(57, $this->importer()->fromUrl('https://cdn.example.com/foto?w=800', null, []));
+    }
+
+    public function testFailedDownloadIsReportedAndCleansUp(): void
+    {
+        Functions\when('wp_http_validate_url')->returnArg();
+        Functions\when('wp_safe_remote_get')->justReturn(new WP_Error('http_request_failed', 'Not Found'));
+
+        $result = $this->importer()->fromUrl('https://example.com/fehlt.jpg', null, []);
+
+        self::assertSame('lit_validation_failed', $result->get_error_code());
+        self::assertStringContainsString('Not Found', $result->get_error_message());
+        $this->assertTempFilesRemoved();
+    }
+
+    public function testHttpErrorStatusIsReported(): void
+    {
+        $this->respond('<html>404</html>', 404);
+        Functions\expect('media_handle_sideload')->never();
+
+        $result = $this->importer()->fromUrl('https://example.com/fehlt.jpg', null, []);
+
+        self::assertSame('lit_validation_failed', $result->get_error_code());
+        self::assertStringContainsString('404', $result->get_error_message());
+        $this->assertTempFilesRemoved();
+    }
+
+    public function testOversizedContentLengthIsRejected(): void
+    {
+        $this->respond('x', 200, ['content-length' => (string) (5 * 1024 * 1024)]);
+        Functions\expect('media_handle_sideload')->never();
+
+        $result = $this->importer()->fromUrl('https://example.com/gross.jpg', null, []);
+
+        self::assertSame('lit_validation_failed', $result->get_error_code());
+        self::assertStringContainsString('Limit 1 MB', $result->get_error_message());
+        $this->assertTempFilesRemoved();
+    }
+
+    public function testDownloadCutOffAtTheLimitIsRejected(): void
+    {
+        $this->respond(str_repeat('x', 1024 * 1024 + 1));
+        Functions\expect('media_handle_sideload')->never();
+
+        $result = $this->importer()->fromUrl('https://example.com/gross.jpg', null, []);
+
+        self::assertSame('lit_validation_failed', $result->get_error_code());
+        self::assertStringContainsString('Limit 1 MB', $result->get_error_message());
+        $this->assertTempFilesRemoved();
+    }
+}
@@ -19,6 +19,8 @@ final class MediaIntegrationTest extends TestCase
        'lit/media-search',
        'lit/media-get',
        'lit/media-preview',
+        'lit/media-upload-from-url',
+        'lit/media-upload',
        'lit/media-download',
    ];

@@ -0,0 +1,157 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Integrations\Media;
+
+use Brain\Monkey\Functions;
+use LIT\MCP\Abilities\Errors;
+use LIT\MCP\Abilities\WriteFailed;
+use LIT\MCP\ChangeLog\ChangeLog;
+use LIT\MCP\Integrations\Media\MediaImporter;
+use LIT\MCP\Integrations\Media\MediaPresenter;
+use LIT\MCP\Integrations\Media\MediaUploadAbility;
+use LIT\MCP\Integrations\Media\MediaUploadFromUrlAbility;
+use LIT\MCP\Integrations\Media\MediaUploads;
+use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
+use LIT\MCP\Limits;
+use LIT\MCP\Tests\Unit\TestCase;
+use Mockery;
+use RuntimeException;
+use WP_Post;
+
+final class MediaUploadAbilitiesTest extends TestCase
+{
+    private function uploads(?ChangeLog $log = null): MediaUploads
+    {
+        $presenter = Mockery::mock(MediaPresenter::class);
+        $presenter->allows('summary')->andReturn(['id' => 55, 'title' => 'Logo']);
+        $schema = Mockery::mock(ContentSchema::class);
+        $schema->allows('isManaged')->andReturn(true);
+
+        return new MediaUploads($presenter, $log ?? Mockery::mock(ChangeLog::class), $schema);
+    }
+
+    private function savedAttachment(): void
+    {
+        Functions\when('get_post')->justReturn(new WP_Post(['ID' => 55, 'post_type' => 'attachment', 'post_title' => 'Logo']));
+        Functions\when('get_edit_post_link')->justReturn('https://kunde.de/wp-admin/post.php?post=55&action=edit');
+    }
+
+    public function testUploadFromUrlReportsTheNewAttachment(): void
+    {
+        $this->savedAttachment();
+        $importer = Mockery::mock(MediaImporter::class);
+        $importer->expects('fromUrl')->with('https://example.com/logo.png', null, ['alt' => 'Logo'])->andReturn(55);
+        $log = Mockery::mock(ChangeLog::class);
+        $log->expects('record')->with('lit/media-upload-from-url', 'attachment', '55', Mockery::type('string'))->andReturn(3);
+
+        $result = (new MediaUploadFromUrlAbility($importer, $this->uploads($log)))
+            ->execute(['url' => 'https://example.com/logo.png', 'alt' => 'Logo']);
+
+        self::assertSame(['id' => 55, 'title' => 'Logo'], $result['attachment']);
+        self::assertSame(['id' => '55', 'type' => 'attachment', 'action' => 'created', 'label' => 'Logo'], $result['changed'][0]);
+        self::assertSame(3, $result['log_id']);
+        self::assertSame('https://kunde.de/wp-admin/post.php?post=55&action=edit', $result['edit_url']);
+        self::assertSame([], $result['warnings']);
+    }
+
+    public function testBase64UploadPassesFilenameDataAndMeta(): void
+    {
+        $this->savedAttachment();
+        $importer = Mockery::mock(MediaImporter::class);
+        $importer->expects('fromBase64')->with('AAAA', 'x.png', ['title' => 'Logo', 'post_id' => 5])->andReturn(55);
+        $log = Mockery::mock(ChangeLog::class);
+        $log->expects('record')->with('lit/media-upload', 'attachment', '55', Mockery::type('string'))->andReturn(4);
+
+        $result = (new MediaUploadAbility($importer, $this->uploads($log), new Limits()))
+            ->execute(['filename' => 'x.png', 'data' => 'AAAA', 'title' => 'Logo', 'post_id' => 5]);
+
+        self::assertTrue($result['ok']);
+        self::assertSame(4, $result['log_id']);
+    }
+
+    public function testAFailingChangeLogIsOnlyAWarning(): void
+    {
+        $this->savedAttachment();
+        $importer = Mockery::mock(MediaImporter::class);
+        $importer->allows('fromUrl')->andReturn(55);
+        $log = Mockery::mock(ChangeLog::class);
+        $log->allows('record')->andThrow(new RuntimeException('db down'));
+        // error_log() is a PHP internal and cannot be stubbed; redirect it to a temp file instead.
+        $file = (string) tempnam(sys_get_temp_dir(), 'lit-log');
+        $previous = ini_set('error_log', $file);
+        try {
+            $result = (new MediaUploadFromUrlAbility($importer, $this->uploads($log)))
+                ->execute(['url' => 'https://example.com/logo.png']);
+            self::assertStringContainsString('db down', (string) file_get_contents($file));
+        } finally {
+            ini_set('error_log', (string) $previous);
+            unlink($file);
+        }
+
+        self::assertTrue($result['ok']);
+        self::assertNull($result['log_id']);
+        self::assertStringContainsString('Medium 55 ist gespeichert', $result['warnings'][0]);
+    }
+
+    public function testImporterErrorsArePassedThrough(): void
+    {
+        $importer = Mockery::mock(MediaImporter::class);
+        $importer->allows('fromBase64')->andReturn(Errors::invalidInput('zu groß'));
+
+        $result = (new MediaUploadAbility($importer, $this->uploads(), new Limits()))
+            ->execute(['filename' => 'x.png', 'data' => 'AAAA']);
+
+        self::assertSame('lit_validation_failed', $result->get_error_code());
+    }
+
+    public function testAPartialUploadIsLoggedAsPartialAndRethrown(): void
+    {
+        $failure = new WriteFailed('Alt-Text fehlt.', false, 55);
+        $importer = Mockery::mock(MediaImporter::class);
+        $importer->allows('fromUrl')->andThrow($failure);
+        $log = Mockery::mock(ChangeLog::class);
+        $log->expects('recordPartial')->with('lit/media-upload-from-url', 'attachment', '55', Mockery::type('string'));
+
+        $this->expectExceptionObject($failure);
+        (new MediaUploadFromUrlAbility($importer, $this->uploads($log)))->execute(['url' => 'https://example.com/a.png']);
+    }
+
+    public function testPermissionNeedsUploadRightsAndEditRightsOnTheParent(): void
+    {
+        Functions\when('current_user_can')->alias(static fn (string $cap, int $id = 0): bool => $cap === 'upload_files');
+        Functions\when('get_post')->justReturn(new WP_Post(['ID' => 5, 'post_type' => 'page', 'post_status' => 'publish']));
+        $ability = new MediaUploadFromUrlAbility(Mockery::mock(MediaImporter::class), $this->uploads());
+
+        self::assertTrue($ability->permission(['url' => 'https://example.com/a.png']));
+        self::assertSame('lit_forbidden', $ability->permission(['url' => 'https://example.com/a.png', 'post_id' => 5])->get_error_code());
+    }
+
+    public function testPermissionRefusesUsersWithoutUploadRights(): void
+    {
+        Functions\when('current_user_can')->justReturn(false);
+        $ability = new MediaUploadAbility(Mockery::mock(MediaImporter::class), $this->uploads(), new Limits());
+
+        self::assertSame('lit_forbidden', $ability->permission(['filename' => 'a.png', 'data' => 'AAAA'])->get_error_code());
+    }
+
+    public function testUploadsForAParentThatDoesNotExistAreRefused(): void
+    {
+        Functions\when('current_user_can')->justReturn(true);
+        Functions\when('get_post')->justReturn(null);
+        $ability = new MediaUploadAbility(Mockery::mock(MediaImporter::class), $this->uploads(), new Limits());
+
+        self::assertSame('lit_not_found', $ability->permission(['filename' => 'a.png', 'data' => 'AAAA', 'post_id' => 9])->get_error_code());
+    }
+
+    public function testDescriptionNamesTheConfiguredLimit(): void
+    {
+        Functions\when('get_option')->justReturn(['upload_mb' => 8]);
+        $ability = new MediaUploadAbility(Mockery::mock(MediaImporter::class), $this->uploads(), new Limits());
+
+        self::assertStringContainsString('8 MB', $ability->description());
+        self::assertFalse($ability->isDirect());
+        self::assertTrue((new MediaUploadFromUrlAbility(Mockery::mock(MediaImporter::class), $this->uploads()))->isDirect());
+    }
+}