clean install

web/core/modules/media/src/Controller/MediaFilterController.php

@@ -0,0 +1,173 @@
+<?php
+
+namespace Drupal\media\Controller;
+
+use Drupal\Core\Access\AccessResult;
+use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
+use Drupal\Core\Entity\ContentEntityStorageInterface;
+use Drupal\Core\Entity\EntityRepositoryInterface;
+use Drupal\Core\Render\RendererInterface;
+use Drupal\Core\Session\AccountInterface;
+use Drupal\filter\FilterFormatInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+/**
+ * Controller which renders a preview of the provided text.
+ *
+ * @internal
+ *   This is an internal part of the media system in Drupal core and may be
+ *   subject to change in minor releases. This class should not be
+ *   instantiated or extended by external code.
+ */
+class MediaFilterController implements ContainerInjectionInterface {
+
+  /**
+   * The renderer service.
+   *
+   * @var \Drupal\Core\Render\RendererInterface
+   */
+  protected $renderer;
+
+  /**
+   * The media storage.
+   *
+   * @var \Drupal\Core\Entity\ContentEntityStorageInterface
+   */
+  protected $mediaStorage;
+
+  /**
+   * The entity repository.
+   *
+   * @var \Drupal\Core\Entity\EntityRepositoryInterface
+   */
+  protected $entityRepository;
+
+  /**
+   * Constructs an MediaFilterController instance.
+   *
+   * @param \Drupal\Core\Render\RendererInterface $renderer
+   *   The renderer service.
+   * @param \Drupal\Core\Entity\ContentEntityStorageInterface $media_storage
+   *   The media storage.
+   * @param \Drupal\Core\Entity\EntityRepositoryInterface $entity_repository
+   *   The entity repository.
+   */
+  public function __construct(RendererInterface $renderer, ContentEntityStorageInterface $media_storage, EntityRepositoryInterface $entity_repository) {
+    $this->renderer = $renderer;
+    $this->mediaStorage = $media_storage;
+    $this->entityRepository = $entity_repository;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('renderer'),
+      $container->get('entity_type.manager')->getStorage('media'),
+      $container->get('entity.repository')
+    );
+  }
+
+  /**
+   * Returns a HTML response containing a preview of the text after filtering.
+   *
+   * Applies all of the given text format's filters, not just the `media_embed`
+   * filter, because for example `filter_align` and `filter_caption` may apply
+   * to it as well.
+   *
+   * @param \Symfony\Component\HttpFoundation\Request $request
+   *   The request object.
+   * @param \Drupal\filter\FilterFormatInterface $filter_format
+   *   The text format.
+   *
+   * @return \Symfony\Component\HttpFoundation\Response
+   *   The filtered text.
+   *
+   * @throws \Symfony\Component\HttpKernel\Exception\NotFoundHttpException
+   *   Throws an exception if 'text' parameter is not found in the query
+   *   string.
+   *
+   * @see \Drupal\editor\EditorController::getUntransformedText
+   */
+  public function preview(Request $request, FilterFormatInterface $filter_format) {
+    self::checkCsrf($request, \Drupal::currentUser());
+
+    $text = $request->query->get('text');
+    $uuid = $request->query->get('uuid');
+    if ($text == '' || $uuid == '') {
+      throw new NotFoundHttpException();
+    }
+
+    $build = [
+      '#type' => 'processed_text',
+      '#text' => $text,
+      '#format' => $filter_format->id(),
+    ];
+    $html = $this->renderer->renderInIsolation($build);
+
+    // Load the media item so we can embed the label in the response, for use
+    // in an ARIA label.
+    $headers = [];
+    if ($media = $this->entityRepository->loadEntityByUuid('media', $uuid)) {
+      $headers['Drupal-Media-Label'] = $this->entityRepository->getTranslationFromContext($media)->label();
+    }
+
+    // Note that we intentionally do not use:
+    // - \Drupal\Core\Cache\CacheableResponse because caching it on the server
+    //   side is wasteful, hence there is no need for cacheability metadata.
+    // - \Drupal\Core\Render\HtmlResponse because there is no need for
+    //   attachments nor cacheability metadata.
+    return (new Response($html, 200, $headers))
+      // Do not allow any intermediary to cache the response, only the end user.
+      ->setPrivate()
+      // Allow the end user to cache it for up to 5 minutes.
+      ->setMaxAge(300);
+  }
+
+  /**
+   * Checks access based on media_embed filter status on the text format.
+   *
+   * @param \Drupal\filter\FilterFormatInterface $filter_format
+   *   The text format for which to check access.
+   *
+   * @return \Drupal\Core\Access\AccessResultInterface
+   *   The access result.
+   */
+  public static function formatUsesMediaEmbedFilter(FilterFormatInterface $filter_format) {
+    $filters = $filter_format->filters();
+    return AccessResult::allowedIf($filters->has('media_embed') && $filters->get('media_embed')->status)
+      ->addCacheableDependency($filter_format);
+  }
+
+  /**
+   * Throws an AccessDeniedHttpException if the request fails CSRF validation.
+   *
+   * This is used instead of \Drupal\Core\Access\CsrfAccessCheck, in order to
+   * allow access for anonymous users.
+   *
+   * @todo Refactor this to an access checker.
+   */
+  private static function checkCsrf(Request $request, AccountInterface $account) {
+    $header = 'X-Drupal-MediaPreview-CSRF-Token';
+
+    if (!$request->headers->has($header)) {
+      throw new AccessDeniedHttpException();
+    }
+    if ($account->isAnonymous()) {
+      // For anonymous users, just the presence of the custom header is
+      // sufficient protection.
+      return;
+    }
+    // For authenticated users, validate the token value.
+    $token = $request->headers->get($header);
+    if (!\Drupal::csrfToken()->validate($token, $header)) {
+      throw new AccessDeniedHttpException();
+    }
+  }
+
+}

web/core/modules/media/src/Controller/OEmbedIframeController.php

@@ -0,0 +1,225 @@
+<?php
+
+namespace Drupal\media\Controller;
+
+use Drupal\Component\Utility\Crypt;
+use Drupal\Core\Cache\CacheableMetadata;
+use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
+use Drupal\Core\Render\BubbleableMetadata;
+use Drupal\Core\Render\HtmlResponse;
+use Drupal\Core\Render\RenderContext;
+use Drupal\Core\Render\RendererInterface;
+use Drupal\Core\Url;
+use Drupal\media\IFrameMarkup;
+use Drupal\media\IFrameUrlHelper;
+use Drupal\media\OEmbed\ResourceException;
+use Drupal\media\OEmbed\ResourceFetcherInterface;
+use Drupal\media\OEmbed\UrlResolverInterface;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
+
+/**
+ * Controller which renders an oEmbed resource in a bare page (without blocks).
+ *
+ * This controller is meant to render untrusted third-party HTML returned by
+ * an oEmbed provider in an iframe, so as to mitigate the potential dangers of
+ * of displaying third-party markup (i.e., XSS). The HTML returned by this
+ * controller should not be trusted, and should *never* be displayed outside
+ * of an iframe.
+ *
+ * @internal
+ *   This is an internal part of the media system in Drupal core and may be
+ *   subject to change in minor releases. This class should not be
+ *   instantiated or extended by external code.
+ */
+class OEmbedIframeController implements ContainerInjectionInterface {
+
+  /**
+   * The oEmbed resource fetcher service.
+   *
+   * @var \Drupal\media\OEmbed\ResourceFetcherInterface
+   */
+  protected $resourceFetcher;
+
+  /**
+   * The oEmbed URL resolver service.
+   *
+   * @var \Drupal\media\OEmbed\UrlResolverInterface
+   */
+  protected $urlResolver;
+
+  /**
+   * The renderer service.
+   *
+   * @var \Drupal\Core\Render\RendererInterface
+   */
+  protected $renderer;
+
+  /**
+   * The logger channel.
+   *
+   * @var \Psr\Log\LoggerInterface
+   */
+  protected $logger;
+
+  /**
+   * The iFrame URL helper service.
+   *
+   * @var \Drupal\media\IFrameUrlHelper
+   */
+  protected $iFrameUrlHelper;
+
+  /**
+   * Constructs an OEmbedIframeController instance.
+   *
+   * @param \Drupal\media\OEmbed\ResourceFetcherInterface $resource_fetcher
+   *   The oEmbed resource fetcher service.
+   * @param \Drupal\media\OEmbed\UrlResolverInterface $url_resolver
+   *   The oEmbed URL resolver service.
+   * @param \Drupal\Core\Render\RendererInterface $renderer
+   *   The renderer service.
+   * @param \Psr\Log\LoggerInterface $logger
+   *   The logger channel.
+   * @param \Drupal\media\IFrameUrlHelper $iframe_url_helper
+   *   The iFrame URL helper service.
+   */
+  public function __construct(ResourceFetcherInterface $resource_fetcher, UrlResolverInterface $url_resolver, RendererInterface $renderer, LoggerInterface $logger, IFrameUrlHelper $iframe_url_helper) {
+    $this->resourceFetcher = $resource_fetcher;
+    $this->urlResolver = $url_resolver;
+    $this->renderer = $renderer;
+    $this->logger = $logger;
+    $this->iFrameUrlHelper = $iframe_url_helper;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('media.oembed.resource_fetcher'),
+      $container->get('media.oembed.url_resolver'),
+      $container->get('renderer'),
+      $container->get('logger.factory')->get('media'),
+      $container->get('media.oembed.iframe_url_helper')
+    );
+  }
+
+  /**
+   * Renders an oEmbed resource.
+   *
+   * @param \Symfony\Component\HttpFoundation\Request $request
+   *   The request object.
+   *
+   * @return \Symfony\Component\HttpFoundation\Response
+   *   The response object.
+   *
+   * @throws \Symfony\Component\HttpKernel\Exception\BadRequestHttpException
+   *   Will be thrown if either
+   *   - the 'hash' parameter does not match the expected hash of the 'url'
+   *     parameter;
+   *   - the iframe_domain is set in media.settings and does not match the host
+   *     in the request.
+   */
+  public function render(Request $request) {
+    // @todo Move domain check logic to a separate method.
+    $allowed_domain = \Drupal::config('media.settings')->get('iframe_domain');
+    if ($allowed_domain) {
+      $allowed_host = parse_url($allowed_domain, PHP_URL_HOST);
+      $host = parse_url($request->getSchemeAndHttpHost(), PHP_URL_HOST);
+      if ($allowed_host !== $host) {
+        throw new BadRequestHttpException('This resource is not available');
+      }
+    }
+
+    $url = $request->query->get('url');
+    $max_width = $request->query->getInt('max_width');
+    $max_height = $request->query->getInt('max_height');
+
+    // Hash the URL and max dimensions, and ensure it is equal to the hash
+    // parameter passed in the query string.
+    $hash = $this->iFrameUrlHelper->getHash($url, $max_width, $max_height);
+    if (!hash_equals($hash, $request->query->get('hash', ''))) {
+      throw new BadRequestHttpException('This resource is not available');
+    }
+
+    // Return a response instead of a render array so that the frame content
+    // will not have all the blocks and page elements normally rendered by
+    // Drupal.
+    $response = new HtmlResponse('', HtmlResponse::HTTP_OK, [
+      'Content-Type' => 'text/html; charset=UTF-8',
+    ]);
+    $response->addCacheableDependency(Url::createFromRequest($request));
+
+    try {
+      $resource_url = $this->urlResolver->getResourceUrl($url, $max_width, $max_height);
+      $resource = $this->resourceFetcher->fetchResource($resource_url);
+
+      $placeholder_token = Crypt::randomBytesBase64(55);
+
+      // Render the content in a new render context so that the cacheability
+      // metadata of the rendered HTML will be captured correctly.
+      $element = [
+        '#theme' => 'media_oembed_iframe',
+        '#resource' => $resource,
+        // Even though the resource HTML is untrusted, IFrameMarkup::create()
+        // will create a trusted string. The only reason this is okay is
+        // because we are serving it in an iframe, which will mitigate the
+        // potential dangers of displaying third-party markup.
+        '#media' => IFrameMarkup::create($resource->getHtml()),
+        '#cache' => [
+          // Add the 'rendered' cache tag as this response is not processed by
+          // \Drupal\Core\Render\MainContent\HtmlRenderer::renderResponse().
+          'tags' => ['rendered'],
+        ],
+        '#attached' => [
+          'html_response_attachment_placeholders' => [
+            'styles' => '<css-placeholder token="' . $placeholder_token . '">',
+          ],
+          'library' => [
+            'media/oembed.frame',
+          ],
+        ],
+        '#placeholder_token' => $placeholder_token,
+      ];
+      $context = new RenderContext();
+      $content = $this->renderer->executeInRenderContext($context, function () use ($element) {
+        return $this->renderer->render($element);
+      });
+      $response
+        ->setContent($content)
+        ->setAttachments($element['#attached'])
+        ->addCacheableDependency($resource)
+        ->addCacheableDependency(CacheableMetadata::createFromRenderArray($element));
+
+      // Modules and themes implementing hook_media_oembed_iframe_preprocess()
+      // can add additional #cache and #attachments to a render array. If this
+      // occurs, the render context won't be empty, and we need to ensure the
+      // added metadata is bubbled up to the response.
+      // @see \Drupal\Core\Theme\ThemeManager::render()
+      if (!$context->isEmpty()) {
+        $bubbleable_metadata = $context->pop();
+        assert($bubbleable_metadata instanceof BubbleableMetadata);
+        $response->addCacheableDependency($bubbleable_metadata);
+        $response->addAttachments($bubbleable_metadata->getAttachments());
+      }
+    }
+    catch (ResourceException $e) {
+      // Prevent the response from being cached.
+      $response->setMaxAge(0);
+
+      // The oEmbed system makes heavy use of exception wrapping, so log the
+      // entire exception chain to help with troubleshooting.
+      do {
+        // @todo Log additional information from ResourceException, to help with
+        // debugging, in https://www.drupal.org/project/drupal/issues/2972846.
+        $this->logger->error($e->getMessage());
+        $e = $e->getPrevious();
+      } while ($e);
+    }
+
+    return $response;
+  }
+
+}