Add test coverage for .htaccess rules

Is this also going to cover the .htaccess execution prevention rules in files, tmp, and private? If so, that should be added the the summary. If not, we should clarify the title a bit.

#1956698: Prevent access to YAML files using .htaccess and web.config is in, so unpostpone.

Begun in Valencia Drupal Ladder 2014

I am happy to work on this.

Here is a patch adding tests for the files in listed in the htaccess as being excluded. I have included two files, one of which has a modified htaccess to show that the test fails when the test is able to access those files.

Sorry, the patch files were missing some of the changes. These patch files have the new files created for testing access. Also changed the patch file names to follow convention better.

For the bot

That was just the bot being thorough. ;)

Not enough tests failed in test bot, this patch is just to check which tests did fail.

+++ b/core/modules/system/src/Tests/System/HtaccessTest.php
@@ -15,15 +15,61 @@
+    foreach($files as $file) {

This should be foreach (.

Could you fix the parameter annotation in assertNoFileAccess(). It does not include the data type. I feel this is a justified change in this issue.

1. +++ b/core/modules/system/src/Tests/System/HtaccessTest.php
   @@ -15,15 +15,61 @@
   +    $temp_files_exts = [
   +      'sw',
   +      'swop',
   +      'bak',
   +      'orig',
   +      'save'
   +    ];
   

   I like that you differentiate files that may start with a '.'. A poorly-configured web server may let those through. Are you sure all these file types usually begin with a '.'?

2. +++ b/core/modules/system/src/Tests/System/HtaccessTest.php
   @@ -15,15 +15,61 @@
   +      'save'
   

   The code style is to put a comma here.

Thanks for your feedback, I have made those changes in this patch. In terms of the previous "fail" patch to prove these tests work, it looks like the test bot may have another htaccess file or other apache config that is still preventing access to most of the files (despite the modified htaccess file in the "fail" patch).

EDIT: Sorry please ignore this patch file, it has htaccess modifications in it. Please see comment #20

Sorry, this is the patch file without htaccess changes.

Modified the htaccess to allow access to the specified files to override the htaccess on the test bot website which was previously causing conflicts.

The test only covers files that are blocked by Drupal's htaccess that aren't temporary files (starting with a dot). I checked the default configuration on OS X, CentOs and Ubuntu and they all have IndexIgnore rules which block dot files by default.

Updated some comments to make more sense and made some other general improvements.

Modified a comment to have better wording.

Eric has been working on this at DrupalSouth. Patch looks good and the tests add some great value. Nice work.

@Eric115 Cool! You should get in the habit of providing interdiffs when you make changes in new patches.

+++ b/core/modules/system/src/Tests/System/HtaccessTest.php
@@ -15,21 +15,51 @@
+   *   An array of file paths to be access tested.

"access-tested" should be hyphenated.

Added the beta phase evaluation, which is needed to have issues committed right now.

"access-tested" should be hyphenated.

Really?? Can you expand on that, I don't feel like they should be hyphenated when the nouns come first.

"Access-tested" is a compound forming two nouns into a verb. Those are hyphenated.

Let's fix that comment please.

Here is the patch with the hyphen in the comment. Also I have uploaded an interdiff.

Looks good.

diff --git a/core/modules/simpletest/files/htaccessTestFiles/access_test.engine b/core/modules/simpletest/files/htaccessTestFiles/access_test.engine
...
diff --git a/core/modules/simpletest/files/htaccessTestFiles/access_test.inc b/core/modules/simpletest/files/htaccessTestFiles/access_test.inc
...
diff --git a/core/modules/simpletest/files/htaccessTestFiles/access_test.install b/core/modules/simpletest/files/htaccessTestFiles/access_test.install
...
diff --git a/core/modules/simpletest/files/htaccessTestFiles/access_test.make b/core/modules/simpletest/files/htaccessTestFiles/access_test.make
...
diff --git a/core/modules/simpletest/files/htaccessTestFiles/access_test.module b/core/modules/simpletest/files/htaccessTestFiles/access_test.module
...
diff --git a/core/modules/simpletest/files/htaccessTestFiles/access_test.po b/core/modules/simpletest/files/htaccessTestFiles/access_test.po
...
diff --git a/core/modules/simpletest/files/htaccessTestFiles/access_test.profile b/core/modules/simpletest/files/htaccessTestFiles/access_test.profile
...
diff --git a/core/modules/simpletest/files/htaccessTestFiles/access_test.sh b/core/modules/simpletest/files/htaccessTestFiles/access_test.sh
...
diff --git a/core/modules/simpletest/files/htaccessTestFiles/access_test.sql b/core/modules/simpletest/files/htaccessTestFiles/access_test.sql
...
diff --git a/core/modules/simpletest/files/htaccessTestFiles/access_test.theme b/core/modules/simpletest/files/htaccessTestFiles/access_test.theme
...
diff --git a/core/modules/simpletest/files/htaccessTestFiles/access_test.tpl.php b/core/modules/simpletest/files/htaccessTestFiles/access_test.tpl.php
...
diff --git a/core/modules/simpletest/files/htaccessTestFiles/access_test.twig b/core/modules/simpletest/files/htaccessTestFiles/access_test.twig
...
diff --git a/core/modules/simpletest/files/htaccessTestFiles/access_test.xtmpl b/core/modules/simpletest/files/htaccessTestFiles/access_test.xtmpl
...
diff --git a/core/modules/simpletest/files/htaccessTestFiles/access_test.yml b/core/modules/simpletest/files/htaccessTestFiles/access_test.yml
...
+++ b/core/modules/system/src/Tests/System/HtaccessTest.php

These files belong in core/modules/system/tests/fixtures/HtaccessTest since the test is in system.

Thanks you for the feedback so far everyone.
Here is a new patch file with the files moved to core/modules/system/tests/fixtures/HtaccessTest.

The interdiff is missing the change to drupal_get_path() but the main patch looks good and addresses #38. Back to RTBC.

Adding test coverage is not blocked during beta. Committed 3874b0c and pushed to 8.0.x. Thanks!