SVGPreProcessorTest.php

Go to the documentation of this file.

<?php

namespace ILIAS\FileUpload\Processor;

use PHPUnit\Framework\Attributes\DataProvider;

require_once('./vendor/composer/vendor/autoload.php');

use PHPUnit\Framework\TestCase;
use ILIAS\FileUpload\DTO\Metadata;
use ILIAS\Filesystem\Stream\Streams;
use ILIAS\FileUpload\DTO\ProcessingStatus;

class SVGPreProcessorTest extends TestCase
{
    protected function getPreProcessor(): SVGBlacklistPreProcessor
    {
        return new SVGBlacklistPreProcessor(
            'The SVG file contains malicious code.',
            '(script)',
            '(base64)',
            ''
        );
    }

    public static function maliciousSVGProvider(): \Iterator
    {
        yield [
            '<svg width="100" height="100">
    <foreignObject width="100%" height="100%">
        <script>alert(document.domain);</script>
    </foreignObject>
</svg>',
            'script'
        ];
        yield [
            '<svg width="100" height="100">
    <foreignObject width="100%" height="100%" onclick="alert(document.domain);">

    </foreignObject>
</svg>',
            'onclick'
        ];
        yield [
            '<svg version="1.1" baseProfile="full"
xmlns="http://www.w3.org/2000/svg">
<rect width="100" height="100" style="fill:rgb(0,0,255);" />
<script type="text/javascript">
alert("XSS in SVG on " + document.domain );
</script>
</svg>',
            'script'
        ];
        yield [
            '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<use xlink:href="data:application/xml;base64 ,
PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5r
PSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9I
jUwIiBjeD0iMTAwIiBjeT0iMTAwIiBzdHlsZT0iZmlsbDogI0YwMCI+CjxzZXQgYXR0cmlidXRlTm
FtZT0iZmlsbCIgYXR0cmlidXRlVHlwZT0iQ1NTIiBvbmJlZ2luPSdhbGVydChkb2N1bWVudC5jb29r
aWUpJwpvbmVuZD0nYWxlcnQoIm9uZW5kIiknIHRvPSIjMDBGIiBiZWdpbj0iMXMiIGR1cj0iNXMiIC
8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/>
</svg>',
            'base64'
        ];
    }

    #[DataProvider('maliciousSVGProvider')]
    public function testMaliciousSVG(string $malicious_svg, string $type): void
    {
        $preProcessor = $this->getPreProcessor();
        $stream = Streams::ofString($malicious_svg);
        $metadata = new Metadata('test.svg', 100, 'image/svg+xml');

        $result = $preProcessor->process($stream, $metadata);

        $this->assertNotSame(ProcessingStatus::OK, $result->getCode());
        $this->assertSame(ProcessingStatus::DENIED, $result->getCode());
        $this->assertSame('The SVG file contains malicious code. (' . $type . ')', $result->getMessage());
    }

    public function testSaneSVG(): void
    {
        $svg = '<svg version="1.1" baseProfile="full"
xmlns="http://www.w3.org/2000/svg">
<rect width="100" height="100" style="fill:rgb(0,0,255);" />
</svg>';

        $preProcessor = $this->getPreProcessor();
        $stream = Streams::ofString($svg);
        $metadata = new Metadata('test.svg', 100, 'image/svg+xml');

        $result = $preProcessor->process($stream, $metadata);

        $this->assertSame(ProcessingStatus::OK, $result->getCode());
        $this->assertNotSame(ProcessingStatus::REJECTED, $result->getCode());
        $this->assertSame('SVG OK', $result->getMessage());
    }

    public static function provideSomeComplexSaneSVG(): \Iterator
    {
        yield [__DIR__ . '/../../../../../components/ILIAS/UI/resources/images/media/bigplay.svg'];
        yield [__DIR__ . '/../../../../../components/ILIAS/UI/resources/images/nav/jstree.svg'];
        yield [__DIR__ . '/../../../../../components/ILIAS/UI/resources/images/media/loader.svg'];
        yield [__DIR__ . '/../../../../../components/ILIAS/UI/resources/images/object/col.svg'];
        yield [__DIR__ . '/../../../../../components/ILIAS/UI/resources/images/logo/HeaderIcon.svg'];
        yield [__DIR__ . '/../../../../../components/ILIAS/UI/resources/images/object/answered_not.svg'];
    }

    #[DataProvider('provideSomeComplexSaneSVG')]
    public function testSomeComplexSaneSVG(string $path): void
    {
        $this->assertFileExists($path);
        $svg = file_get_contents($path);

        $preProcessor = $this->getPreProcessor();
        $stream = Streams::ofString($svg);
        $metadata = new Metadata('media/bigplay.svg', 100, 'image/svg+xml');

        $result = $preProcessor->process($stream, $metadata);

        $this->assertSame('SVG OK', $result->getMessage());
        $this->assertSame(ProcessingStatus::OK, $result->getCode());
        $this->assertNotSame(ProcessingStatus::REJECTED, $result->getCode());
    }
}