Filesystem API: Add more specificity to the rules for valid files in validate_file().

This now treats files containing `./` as valid, and also treats files containing a trailing `../` as valid due to widespread use of this pattern in theme and plugin zip files.

Adds tests.

Props Ipstenu, borgesbruno, DavidAnderson, philipjohn, birgire
Fixes #42016, #36170


git-svn-id: https://develop.svn.wordpress.org/trunk@42011 602fd350-edb4-49c9-b593-d223f7449a82

tests/phpunit/tests/functions.php

@@ -1161,4 +1161,147 @@ class Tests_Functions extends WP_UnitTestCase {
 		return $data;
 	}
 
+	/**
+	 * Test file path validation
+	 *
+	 * @ticket 42016
+	 * @dataProvider data_test_validate_file()
+	 *
+	 * @param string $file          File path.
+	 * @param array  $allowed_files List of allowed files.
+	 * @param int    $expected      Expected result.
+	 */
+	public function test_validate_file( $file, $allowed_files, $expected ) {
+		$this->assertSame( $expected, validate_file( $file, $allowed_files ) );
+	}
+
+	/**
+	 * Data provider for file validation.
+	 *
+	 * @return array {
+	 *     @type array $0... {
+	 *         @type string $0 File path.
+	 *         @type array  $1 List of allowed files.
+	 *         @type int    $2 Expected result.
+	 *     }
+	 * }
+	 */
+	public function data_test_validate_file() {
+		return array(
+
+			// Allowed files:
+			array(
+				null,
+				array(),
+				0,
+			),
+			array(
+				'',
+				array(),
+				0,
+			),
+			array(
+				' ',
+				array(),
+				0,
+			),
+			array(
+				'.',
+				array(),
+				0,
+			),
+			array(
+				'..',
+				array(),
+				0,
+			),
+			array(
+				'./',
+				array(),
+				0,
+			),
+			array(
+				'foo.ext',
+				array( 'foo.ext' ),
+				0,
+			),
+			array(
+				'dir/foo.ext',
+				array(),
+				0,
+			),
+			array(
+				'foo..ext',
+				array(),
+				0,
+			),
+			array(
+				'dir/dir/../',
+				array(),
+				0,
+			),
+
+			// Directory traversal:
+			array(
+				'../',
+				array(),
+				1,
+			),
+			array(
+				'../../',
+				array(),
+				1,
+			),
+			array(
+				'../file.ext',
+				array(),
+				1,
+			),
+			array(
+				'../dir/../',
+				array(),
+				1,
+			),
+			array(
+				'/dir/dir/../../',
+				array(),
+				1,
+			),
+			array(
+				'/dir/dir/../../',
+				array( '/dir/dir/../../' ),
+				1,
+			),
+
+			// Windows drives:
+			array(
+				'c:',
+				array(),
+				2,
+			),
+			array(
+				'C:/WINDOWS/system32',
+				array( 'C:/WINDOWS/system32' ),
+				2,
+			),
+
+			// Disallowed files:
+			array(
+				'foo.ext',
+				array( 'bar.ext' ),
+				3,
+			),
+			array(
+				'foo.ext',
+				array( '.ext' ),
+				3,
+			),
+			array(
+				'path/foo.ext',
+				array( 'foo.ext' ),
+				3,
+			),
+
+		);
+	}
 }