468 lines
20 KiB
PHP
468 lines
20 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace LIT\MCP\Tests\Unit\Integrations\Media;
|
|
|
|
use Brain\Monkey\Actions;
|
|
use Brain\Monkey\Filters;
|
|
use Brain\Monkey\Functions;
|
|
use LIT\MCP\Abilities\WriteFailed;
|
|
use LIT\MCP\Integrations\Media\MediaImporter;
|
|
use LIT\MCP\Limits;
|
|
use LIT\MCP\Tests\Unit\TestCase;
|
|
use Mockery;
|
|
use WP_Error;
|
|
|
|
final class MediaImporterTest extends TestCase
|
|
{
|
|
/** Key shapes as in WordPress core's wp_get_mime_types(). */
|
|
private const CORE_MIMES = [
|
|
'jpg|jpeg|jpe' => 'image/jpeg',
|
|
'gif' => 'image/gif',
|
|
'png' => 'image/png',
|
|
'webp' => 'image/webp',
|
|
'avif' => 'image/avif',
|
|
'htm|html' => 'text/html',
|
|
'mp3|m4a|m4b' => 'audio/mpeg',
|
|
'mp4|m4v' => 'video/mp4',
|
|
'pdf' => 'application/pdf',
|
|
];
|
|
|
|
/** @var list<string> */
|
|
private array $tempFiles = [];
|
|
|
|
/** error_log() is a PHP internal and cannot be stubbed; it is redirected to this file. */
|
|
private string $errorLog = '';
|
|
private string|false $previousErrorLog = false;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
$this->errorLog = (string) tempnam(sys_get_temp_dir(), 'lit-mcp-log');
|
|
$this->previousErrorLog = ini_set('error_log', $this->errorLog);
|
|
Functions\when('get_option')->justReturn(['upload_mb' => 1]);
|
|
Functions\when('wp_tempnam')->alias(function (): string {
|
|
$file = (string) tempnam(sys_get_temp_dir(), 'lit-up');
|
|
$this->tempFiles[] = $file;
|
|
return $file;
|
|
});
|
|
Functions\when('wp_delete_file')->alias(static function (string $file): void {
|
|
if (is_file($file)) {
|
|
unlink($file);
|
|
}
|
|
});
|
|
Functions\when('sanitize_file_name')->returnArg();
|
|
Functions\when('wp_basename')->alias('basename');
|
|
Functions\when('wp_parse_url')->alias('parse_url');
|
|
Functions\when('get_allowed_mime_types')->justReturn(self::CORE_MIMES);
|
|
Functions\when('wp_check_filetype')->alias(static function (string $filename, array $mimes): array {
|
|
foreach ($mimes as $extensions => $mime) {
|
|
if (preg_match('!\.(' . $extensions . ')$!i', $filename, $match)) {
|
|
return ['ext' => $match[1], 'type' => $mime];
|
|
}
|
|
}
|
|
|
|
return ['ext' => false, 'type' => false];
|
|
});
|
|
}
|
|
|
|
protected function tearDown(): void
|
|
{
|
|
ini_set('error_log', (string) $this->previousErrorLog);
|
|
if (is_file($this->errorLog)) {
|
|
unlink($this->errorLog);
|
|
}
|
|
foreach ($this->tempFiles as $file) {
|
|
if (is_file($file)) {
|
|
unlink($file);
|
|
}
|
|
}
|
|
parent::tearDown();
|
|
}
|
|
|
|
private function importer(): MediaImporter
|
|
{
|
|
return new MediaImporter(new Limits());
|
|
}
|
|
|
|
private function assertTempFilesRemoved(): void
|
|
{
|
|
foreach ($this->tempFiles as $file) {
|
|
self::assertFileDoesNotExist($file);
|
|
}
|
|
}
|
|
|
|
/** Lets the next wp_safe_remote_get write $body into the stream target and answer with $headers. */
|
|
private function respond(string $body, int $code = 200, array $headers = []): void
|
|
{
|
|
Functions\when('wp_safe_remote_get')->alias(static function (string $url, array $args) use ($body, $code, $headers): array {
|
|
file_put_contents($args['filename'], $body);
|
|
return ['response' => ['code' => $code], 'headers' => $headers, 'filename' => $args['filename']];
|
|
});
|
|
$this->responseReaders();
|
|
}
|
|
|
|
private function responseReaders(): void
|
|
{
|
|
Functions\when('wp_http_validate_url')->returnArg();
|
|
Functions\when('wp_remote_retrieve_response_code')->alias(static fn (array $r): int => $r['response']['code']);
|
|
Functions\when('wp_remote_retrieve_header')->alias(
|
|
static fn (array $r, string $name): string => (string) ($r['headers'][$name] ?? '')
|
|
);
|
|
}
|
|
|
|
public function testBase64UploadIsSideloadedWithAltText(): void
|
|
{
|
|
Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
|
|
Functions\expect('media_handle_sideload')->once()
|
|
->with(Mockery::on(static fn (array $file): bool => $file['name'] === 'logo.png' && is_file($file['tmp_name'])), 5, 'Logo')
|
|
->andReturnUsing(static function (array $file): int {
|
|
unlink($file['tmp_name']); // WordPress moves the temp file into uploads.
|
|
return 55;
|
|
});
|
|
Functions\expect('update_post_meta')->once()->with(55, '_wp_attachment_image_alt', 'Firmenlogo')->andReturn(true);
|
|
|
|
$id = $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', [
|
|
'title' => 'Logo',
|
|
'alt' => 'Firmenlogo',
|
|
'post_id' => 5,
|
|
]);
|
|
|
|
self::assertSame(55, $id);
|
|
}
|
|
|
|
public function testOversizedBase64IsRejectedBeforeDecoding(): void
|
|
{
|
|
$result = $this->importer()->fromBase64(str_repeat('A', 2 * 1024 * 1024), 'big.png', []);
|
|
|
|
self::assertSame('lit_validation_failed', $result->get_error_code());
|
|
self::assertStringContainsString('Limit 1 MB', $result->get_error_message());
|
|
self::assertSame([], $this->tempFiles, 'no temp file may be written for an oversized upload');
|
|
}
|
|
|
|
public function testBase64UploadsAreCappedAtTenMegabytesEvenWithAHigherUploadLimit(): void
|
|
{
|
|
Functions\when('get_option')->justReturn(['upload_mb' => 32]);
|
|
|
|
$result = $this->importer()->fromBase64(str_repeat('A', 16 * 1024 * 1024), 'big.png', []);
|
|
|
|
self::assertSame('lit_validation_failed', $result->get_error_code());
|
|
self::assertStringContainsString('Limit 10 MB', $result->get_error_message());
|
|
self::assertStringContainsString('lit/media-upload-from-url', (string) $result->get_error_data()['hint']);
|
|
self::assertSame([], $this->tempFiles);
|
|
}
|
|
|
|
public function testInvalidBase64IsRejected(): void
|
|
{
|
|
$result = $this->importer()->fromBase64('***', 'x.png', []);
|
|
|
|
self::assertSame('lit_validation_failed', $result->get_error_code());
|
|
self::assertSame([], $this->tempFiles);
|
|
}
|
|
|
|
public function testDisguisedFileIsRejectedAndTheTempFileRemoved(): void
|
|
{
|
|
Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => false, 'type' => false, 'proper_filename' => false]);
|
|
Functions\expect('media_handle_sideload')->never();
|
|
|
|
$result = $this->importer()->fromBase64(base64_encode('<?php evil();'), 'bild.png', []);
|
|
|
|
self::assertSame('lit_validation_failed', $result->get_error_code());
|
|
self::assertNotSame([], $this->tempFiles);
|
|
$this->assertTempFilesRemoved();
|
|
}
|
|
|
|
public function testTheWhitelistOnlyKeepsTypesWordPressAllowsTheUser(): void
|
|
{
|
|
Functions\when('get_allowed_mime_types')->justReturn(['png' => 'image/png', 'svg' => 'image/svg+xml']);
|
|
Functions\expect('wp_check_filetype_and_ext')->once()
|
|
->with(Mockery::type('string'), 'logo.png', ['png' => 'image/png'])
|
|
->andReturn(['ext' => false, 'type' => false, 'proper_filename' => false]);
|
|
|
|
$result = $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', []);
|
|
|
|
self::assertSame('lit_validation_failed', $result->get_error_code());
|
|
self::assertStringContainsString('png', $result->get_error_message());
|
|
}
|
|
|
|
public function testSideloadFailureIsAWriteFailureAndCleansUp(): void
|
|
{
|
|
Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
|
|
Functions\when('media_handle_sideload')->justReturn(new WP_Error('upload_error', 'Verzeichnis nicht beschreibbar'));
|
|
|
|
Functions\when('media_handle_sideload')->justReturn(
|
|
new WP_Error('upload_error', 'Verzeichnis /var/www/html/wp-content/uploads/2026/09 nicht beschreibbar')
|
|
);
|
|
|
|
$result = $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', []);
|
|
$logged = (string) file_get_contents($this->errorLog);
|
|
|
|
self::assertSame('lit_write_failed', $result->get_error_code());
|
|
self::assertStringNotContainsString('/var/www', $result->get_error_message());
|
|
self::assertStringNotContainsString('/var/www', (string) json_encode($result->get_error_data()));
|
|
self::assertStringContainsString('WordPress hat die Datei nicht übernommen', $result->get_error_message());
|
|
self::assertStringContainsString('/var/www/html/wp-content/uploads/2026/09 nicht beschreibbar', $logged);
|
|
$this->assertTempFilesRemoved();
|
|
}
|
|
|
|
public function testTitleAndAltTextAreSlashedForWordPress(): void
|
|
{
|
|
Functions\when('wp_slash')->alias('addslashes');
|
|
Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
|
|
Functions\expect('media_handle_sideload')->once()
|
|
->with(Mockery::type('array'), 0, 'C:\\\\Pfad')
|
|
->andReturn(55);
|
|
Functions\expect('update_post_meta')->once()
|
|
->with(55, '_wp_attachment_image_alt', 'Back\\\\slash')
|
|
->andReturn(true);
|
|
|
|
$id = $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', [
|
|
'title' => 'C:\\Pfad',
|
|
'alt' => 'Back\\slash',
|
|
]);
|
|
|
|
self::assertSame(55, $id);
|
|
}
|
|
|
|
public function testFailedAltTextDeletesTheNewAttachmentAgain(): void
|
|
{
|
|
Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
|
|
Functions\when('media_handle_sideload')->justReturn(55);
|
|
Functions\when('update_post_meta')->justReturn(false);
|
|
Functions\when('get_post_meta')->justReturn('');
|
|
Functions\expect('wp_delete_attachment')->once()->with(55, true)->andReturn(new \stdClass());
|
|
|
|
try {
|
|
$this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', ['alt' => 'Logo']);
|
|
self::fail('WriteFailed expected');
|
|
} catch (WriteFailed $e) {
|
|
self::assertTrue($e->rolledBack);
|
|
self::assertSame('lit_write_failed', $e->toError()->get_error_code());
|
|
}
|
|
$this->assertTempFilesRemoved();
|
|
}
|
|
|
|
public function testAltTextFailureWithoutRollbackIsAPartialWriteNamingTheAttachment(): void
|
|
{
|
|
Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
|
|
Functions\when('media_handle_sideload')->justReturn(55);
|
|
Functions\when('update_post_meta')->justReturn(false);
|
|
Functions\when('get_post_meta')->justReturn('');
|
|
Functions\when('wp_delete_attachment')->justReturn(false);
|
|
|
|
try {
|
|
$this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', ['alt' => 'Logo']);
|
|
self::fail('WriteFailed expected');
|
|
} catch (WriteFailed $e) {
|
|
self::assertFalse($e->rolledBack);
|
|
self::assertSame(55, $e->postId);
|
|
$error = $e->toError();
|
|
self::assertSame('lit_partial_write', $error->get_error_code());
|
|
self::assertStringContainsString('Medium 55', $error->get_error_message());
|
|
self::assertSame(55, $error->get_error_data()['attachment_id']);
|
|
}
|
|
}
|
|
|
|
public function testAnAltTextAlreadyTakenFromTheImageIsNoFailure(): void
|
|
{
|
|
Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
|
|
Functions\when('media_handle_sideload')->justReturn(55);
|
|
Functions\when('update_post_meta')->justReturn(false); // Same value already stored (IPTC alt).
|
|
Functions\when('get_post_meta')->justReturn('Logo');
|
|
Functions\expect('wp_delete_attachment')->never();
|
|
|
|
self::assertSame(55, $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', ['alt' => 'Logo']));
|
|
}
|
|
|
|
public function testInternalUrlsAreRejectedWithoutRequest(): void
|
|
{
|
|
Functions\when('wp_http_validate_url')->justReturn(false);
|
|
Functions\expect('wp_safe_remote_get')->never();
|
|
|
|
$result = $this->importer()->fromUrl('http://127.0.0.1/wp-config.php', null, []);
|
|
|
|
self::assertSame('lit_validation_failed', $result->get_error_code());
|
|
}
|
|
|
|
public function testOnlyHttpUrlsAreFetched(): void
|
|
{
|
|
Functions\when('wp_http_validate_url')->returnArg();
|
|
Functions\expect('wp_safe_remote_get')->never();
|
|
|
|
$result = $this->importer()->fromUrl('ftp://example.com/logo.png', null, []);
|
|
|
|
self::assertSame('lit_validation_failed', $result->get_error_code());
|
|
}
|
|
|
|
public function testUrlImportDownloadsSafelyWithTheSizeLimit(): void
|
|
{
|
|
$this->responseReaders();
|
|
Functions\expect('wp_safe_remote_get')->once()->with(
|
|
'https://example.com/bilder/logo.png',
|
|
Mockery::on(static function (array $args): bool {
|
|
file_put_contents($args['filename'], 'PNGDATA');
|
|
return $args['stream'] === true && $args['limit_response_size'] === 1024 * 1024 + 1;
|
|
})
|
|
)->andReturn(['response' => ['code' => 200], 'headers' => []]);
|
|
Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
|
|
Functions\expect('media_handle_sideload')->once()
|
|
->with(Mockery::on(static fn (array $file): bool => $file['name'] === 'logo.png'), 0, null)
|
|
->andReturn(56);
|
|
|
|
self::assertSame(56, $this->importer()->fromUrl('https://example.com/bilder/logo.png', null, []));
|
|
$this->assertTempFilesRemoved();
|
|
}
|
|
|
|
public function testAMissingExtensionIsTakenFromTheContentType(): void
|
|
{
|
|
$this->respond('PNGDATA', 200, ['content-type' => 'image/png; charset=binary']);
|
|
Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
|
|
Functions\expect('media_handle_sideload')->once()
|
|
->with(Mockery::on(static fn (array $file): bool => $file['name'] === 'foto.png'), 0, null)
|
|
->andReturn(57);
|
|
|
|
self::assertSame(57, $this->importer()->fromUrl('https://cdn.example.com/foto?w=800', null, []));
|
|
}
|
|
|
|
public function testFailedDownloadIsReportedAndCleansUp(): void
|
|
{
|
|
Functions\when('wp_http_validate_url')->returnArg();
|
|
Functions\when('wp_safe_remote_get')->justReturn(new WP_Error('http_request_failed', 'Not Found'));
|
|
|
|
$result = $this->importer()->fromUrl('https://example.com/fehlt.jpg', null, []);
|
|
|
|
self::assertSame('lit_validation_failed', $result->get_error_code());
|
|
self::assertStringContainsString('Not Found', $result->get_error_message());
|
|
$this->assertTempFilesRemoved();
|
|
}
|
|
|
|
public function testHttpErrorStatusIsReported(): void
|
|
{
|
|
$this->respond('<html>404</html>', 404);
|
|
Functions\expect('media_handle_sideload')->never();
|
|
|
|
$result = $this->importer()->fromUrl('https://example.com/fehlt.jpg', null, []);
|
|
|
|
self::assertSame('lit_validation_failed', $result->get_error_code());
|
|
self::assertStringContainsString('404', $result->get_error_message());
|
|
$this->assertTempFilesRemoved();
|
|
}
|
|
|
|
public function testOversizedContentLengthIsRejected(): void
|
|
{
|
|
$this->respond('x', 200, ['content-length' => (string) (5 * 1024 * 1024)]);
|
|
Functions\expect('media_handle_sideload')->never();
|
|
|
|
$result = $this->importer()->fromUrl('https://example.com/gross.jpg', null, []);
|
|
|
|
self::assertSame('lit_validation_failed', $result->get_error_code());
|
|
self::assertStringContainsString('Limit 1 MB', $result->get_error_message());
|
|
$this->assertTempFilesRemoved();
|
|
}
|
|
|
|
public function testDownloadCutOffAtTheLimitIsRejected(): void
|
|
{
|
|
$this->respond(str_repeat('x', 1024 * 1024 + 1));
|
|
Functions\expect('media_handle_sideload')->never();
|
|
|
|
$result = $this->importer()->fromUrl('https://example.com/gross.jpg', null, []);
|
|
|
|
self::assertSame('lit_validation_failed', $result->get_error_code());
|
|
self::assertStringContainsString('Limit 1 MB', $result->get_error_message());
|
|
$this->assertTempFilesRemoved();
|
|
}
|
|
|
|
public function testTheWhitelistIsMatchedPerExtensionAgainstCoreKeys(): void
|
|
{
|
|
Functions\expect('wp_check_filetype_and_ext')->once()
|
|
->with(Mockery::type('string'), 'song.mp3', Mockery::on(static function (array $mimes): bool {
|
|
return ($mimes['mp3'] ?? null) === 'audio/mpeg'
|
|
&& ($mimes['jpeg'] ?? null) === 'image/jpeg'
|
|
&& ($mimes['m4v'] ?? null) === 'video/mp4'
|
|
&& ! isset($mimes['m4a'], $mimes['html'], $mimes['htm']);
|
|
}))
|
|
->andReturn(['ext' => 'mp3', 'type' => 'audio/mpeg', 'proper_filename' => false]);
|
|
Functions\when('media_handle_sideload')->justReturn(60);
|
|
|
|
self::assertSame(60, $this->importer()->fromBase64(base64_encode('ID3DATA'), 'song.mp3', []));
|
|
}
|
|
|
|
public function testAnEmptyWhitelistRejectsEverythingInsteadOfFallingBackToAllTypes(): void
|
|
{
|
|
Functions\when('get_allowed_mime_types')->justReturn(['htm|html' => 'text/html']);
|
|
Functions\expect('wp_check_filetype_and_ext')->never();
|
|
Functions\expect('media_handle_sideload')->never();
|
|
|
|
$result = $this->importer()->fromBase64(base64_encode('<html></html>'), 'seite.html', []);
|
|
|
|
self::assertSame('lit_validation_failed', $result->get_error_code());
|
|
$this->assertTempFilesRemoved();
|
|
}
|
|
|
|
public function testTheMovedFileIsRemovedWhenTheAttachmentCannotBeCreated(): void
|
|
{
|
|
Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
|
|
$record = null;
|
|
Filters\expectAdded('wp_handle_upload')->once()->whenHappen(static function (callable $callback) use (&$record): void {
|
|
$record = $callback;
|
|
});
|
|
$moved = (string) tempnam(sys_get_temp_dir(), 'lit-moved');
|
|
$this->tempFiles[] = $moved;
|
|
Functions\when('media_handle_sideload')->alias(static function () use (&$record, $moved): WP_Error {
|
|
$record(['file' => $moved, 'url' => 'https://kunde.de/x.png', 'type' => 'image/png'], 'sideload');
|
|
return new WP_Error('db_insert_error', 'Datenbankfehler');
|
|
});
|
|
|
|
$result = $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', []);
|
|
|
|
self::assertSame('lit_write_failed', $result->get_error_code());
|
|
self::assertFileDoesNotExist($moved);
|
|
self::assertFalse(has_filter('wp_handle_upload'));
|
|
}
|
|
|
|
public function testTheSavedFileIsKeptOnSuccess(): void
|
|
{
|
|
Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]);
|
|
$record = null;
|
|
Filters\expectAdded('wp_handle_upload')->once()->whenHappen(static function (callable $callback) use (&$record): void {
|
|
$record = $callback;
|
|
});
|
|
$moved = (string) tempnam(sys_get_temp_dir(), 'lit-moved');
|
|
$this->tempFiles[] = $moved;
|
|
Functions\when('media_handle_sideload')->alias(static function () use (&$record, $moved): int {
|
|
$record(['file' => $moved], 'sideload');
|
|
return 61;
|
|
});
|
|
|
|
self::assertSame(61, $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', []));
|
|
self::assertFileExists($moved);
|
|
}
|
|
|
|
public function testCurlIsRestrictedToIpv4ForTheImportRequestOnly(): void
|
|
{
|
|
$this->respond('PNGDATA', 200);
|
|
Actions\expectAdded('http_api_curl')->once()->whenHappen(static function (callable $callback): void {
|
|
if (function_exists('curl_init')) {
|
|
$callback(curl_init()); // Must accept a real cURL handle without error.
|
|
}
|
|
});
|
|
Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => false, 'type' => false, 'proper_filename' => false]);
|
|
|
|
$this->importer()->fromUrl('https://example.com/logo.png', null, []);
|
|
|
|
self::assertFalse(has_action('http_api_curl'));
|
|
}
|
|
|
|
public function testAMissingTempFileNameIsAWriteFailure(): void
|
|
{
|
|
Functions\when('wp_http_validate_url')->returnArg();
|
|
Functions\when('wp_tempnam')->justReturn('');
|
|
Functions\expect('wp_safe_remote_get')->never();
|
|
|
|
$result = $this->importer()->fromUrl('https://example.com/logo.png', null, []);
|
|
|
|
self::assertSame('lit_write_failed', $result->get_error_code());
|
|
}
|
|
}
|