Problem/Motivation
Since
#942690: Security harden stream wrappers by defaulting them as remote →
\Drupal\Core\StreamWrapper\PrivateStream and \Drupal\Core\StreamWrapper\PublicStream
have:
/**
* {@inheritdoc}
*/
public static function getType() {
return StreamWrapperInterface::LOCAL_NORMAL;
}
This means public and private file uploads could be included as PHP files. This is a security weakness that seems to have been added by mistake and shoudl be remediated.
Also, StreamWrapperInterface uses class constants which , before PHP 5.6.0 do not support expressions so unlike D7 they are calculated, and it' not clear they are correct in all cases.
D7 uses defines and so it does for NORMAL:
define('STREAM_WRAPPERS_WRITE_VISIBLE', STREAM_WRAPPERS_READ | STREAM_WRAPPERS_WRITE | STREAM_WRAPPERS_VISIBLE)
We should add documentation and tests to verify these calculations are correct.
Proposed resolution
Add tests to insure that each constant that is a combination is correctly calculated to match the component parts.
Remaining tasks
Add tests
review
User interface changes
none
API changes
change stream wrapper types back to not be "local" to avoid possibly security vulnerabilities.
Data model changes
none
Reported by chx as part of the Drupal 8 security bug bounty
https://tracker.bugcrowd.com/submissions/58ebf88424951cadfcd1c3146d6dfc2...
Beta phase evaluation
<!--Uncomment the relevant rows for the issue. -->