Merge pull request #1351 from abraham/file-path

Consistent file validation

Author: abraham

src/TwitterOAuth.php

@@ -359,10 +359,8 @@ public function mediaStatus(string $media_id)
      */
     private function uploadMediaNotChunked(string $path, array $parameters)
     {
-        if (
-            !is_readable($parameters['media']) ||
-            ($file = file_get_contents($parameters['media'])) === false
-        ) {
+        $this->validateMediaPath($parameters['media']);
+        if (($file = file_get_contents($parameters['media'])) === false) {
             throw new \InvalidArgumentException(
                 'You must supply a readable file',
             );
@@ -383,6 +381,7 @@ private function uploadMediaNotChunked(string $path, array $parameters)
      */
     private function uploadMediaChunked(string $path, array $parameters)
     {
+        $this->validateMediaPath($parameters['media']);
         /** @var object $init */
         $init = $this->http(
             'POST',
@@ -430,6 +429,26 @@ private function uploadMediaChunked(string $path, array $parameters)
         return $finalize;
     }
 
+    /**
+     * Validate upload media path before reading from disk.
+     *
+     * @param string $mediaPath
+     */
+    private function validateMediaPath(string $mediaPath): void
+    {
+        if (
+            !stream_is_local($mediaPath) ||
+            !file_exists($mediaPath) ||
+            !is_file($mediaPath) ||
+            is_link($mediaPath) ||
+            !is_readable($mediaPath)
+        ) {
+            throw new \InvalidArgumentException(
+                'You must supply a readable file',
+            );
+        }
+    }
+
     /**
      * Private method to get params for upload media chunked init.
      * Twitter docs: https://dev.x.com/rest/reference/post/media/upload-init.html

tests/TwitterOAuthMediaTest.php

@@ -113,4 +113,44 @@ public function testPostStatusesUpdateWithMediaChunkedException()
         }
         assert($caught);
     }
+
+    public function testUploadRejectsSymlinkForNotChunked()
+    {
+        $target = __DIR__ . '/kitten.jpg';
+        $link = __DIR__ . '/kitten-symlink.jpg';
+
+        @unlink($link);
+        if (!symlink($target, $link)) {
+            $this->markTestSkipped('Unable to create symlink on this system.');
+        }
+
+        try {
+            $this->expectException(\InvalidArgumentException::class);
+            $this->twitter->upload('media/upload', ['media' => $link]);
+        } finally {
+            @unlink($link);
+        }
+    }
+
+    public function testUploadRejectsSymlinkForChunked()
+    {
+        $target = __DIR__ . '/video.mp4';
+        $link = __DIR__ . '/video-symlink.mp4';
+
+        @unlink($link);
+        if (!symlink($target, $link)) {
+            $this->markTestSkipped('Unable to create symlink on this system.');
+        }
+
+        try {
+            $this->expectException(\InvalidArgumentException::class);
+            $this->twitter->upload(
+                'media/upload',
+                ['media' => $link, 'media_type' => 'video/mp4'],
+                ['chunkedUpload' => true],
+            );
+        } finally {
+            @unlink($link);
+        }
+    }
 }