Add test for SA-CORE-2024-002

I added and updated the patch from the private issue.
People from the "Fixed by" section of https://www.drupal.org/sa-core-2024-002 → should probably be credited.

Reading https://www.drupal.org/sa-core-2024-002 → believe this is a good coverage.

I don't think this paragraph contains sufficient information to determine if it is good test coverage or not:

Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site.

The commit corresponding to the SA might be more helpful to review.

Ideally, it would be reviewed by someone with access to the original private issue report (which I've added to the summary). Reviewing it might be a good task for one of our provisional Security Team members.

Another step I would expect to see for reviewing this would to be to revert the commit that fixed SA-CORE-2025-002, and have the test fail as expected, and then document that failure here on the issue.

xjm → credited benjifisher → .

xjm → credited catch → .

xjm → credited kim.pepper → .

xjm → credited larowlan → .

Uploaded an MR with the fix reverted and the unit test added fails

Fail          0.117s testInvalidFile                                                                 
Log           0.442s *** Process execution output ***                                                
    PHPUnit 10.5.46 by Sebastian Bergmann and contributors.
    
    Runtime:       PHP 8.3.22
    Configuration: /builds/issue/drupal-3527408/core/phpunit.xml.dist
    
    F                                                                   1 / 1 (100%)
    
    Time: 00:00.123, Memory: 10.00 MB
    
    CKEditor5Image Controller (Drupal\Tests\ckeditor5\Unit\CKEditor5ImageController)
     ✘ Invalid file
       ┐
       ├ Failed asserting that exception message 'Destination file path is not writable' contains 'The file "foo.txt" exceeds the upload limit defined in your form.'.

So believe this is test coverage works

I still don't think we're quite at a complete RTBC from the above, but I re-reviewed the full details of the private issue and will add my +1 to the RTBC confirming that it does indeed provide test coverage that should prevent the vulnerability from being reintroduced, despite that it is not possible to create an actual full exploit test in this situation. :)