Issue #3186415 by phenaproxima, Charlie ChX Negyesi, walangitan, pianomansam, dan2k3k4, Al Munnings, larowlan, philltran, cilefen, longwave, alexpott, pookmish, kaynen, Lendude, Gábor Hojtsy, rlnorthcutt, ksenzee: Make oEmbed resource fetcher more tolerant of unexpected Content-Type headers

(cherry picked from commit 167686b809)

core/modules/media/src/OEmbed/ResourceFetcher.php

@@ -70,12 +70,16 @@ class ResourceFetcher implements ResourceFetcherInterface {
     if (strstr($format, 'text/xml') || strstr($format, 'application/xml')) {
       $data = $this->parseResourceXml($content, $url);
     }
-    elseif (strstr($format, 'text/javascript') || strstr($format, 'application/json')) {
+    // By default, try to parse the resource data as JSON.
-      $data = Json::decode($content);
-    }
-    // If the response is neither XML nor JSON, we are in bat country.
     else {
-      throw new ResourceException('The fetched resource did not have a valid Content-Type header.', $url);
+      $data = Json::decode($content);
+
+      if (json_last_error() !== JSON_ERROR_NONE) {
+        throw new ResourceException('Error decoding oEmbed resource: ' . json_last_error_msg(), $url);
+      }
+    }
+    if (empty($data) || !is_array($data)) {
+      throw new ResourceException('The oEmbed resource could not be decoded.', $url);
     }
 
     $this->cacheSet($cache_id, $data);

core/modules/media/tests/src/Unit/ResourceFetcherTest.php

@@ -0,0 +1,75 @@
+<?php
+
+namespace Drupal\Tests\media\Unit;
+
+use Drupal\Component\Serialization\Json;
+use Drupal\media\OEmbed\ResourceException;
+use Drupal\media\OEmbed\ResourceFetcher;
+use Drupal\Tests\UnitTestCase;
+use GuzzleHttp\Client;
+use GuzzleHttp\Handler\MockHandler;
+use GuzzleHttp\HandlerStack;
+use GuzzleHttp\Psr7\Response;
+
+/**
+ * @group media
+ *
+ * @coversDefaultClass \Drupal\media\OEmbed\ResourceFetcher
+ */
+class ResourceFetcherTest extends UnitTestCase {
+
+  /**
+   * Tests how the resource fetcher handles unknown Content-Type headers.
+   *
+   * @covers ::fetchResource
+   */
+  public function testUnknownContentTypeHeader(): void {
+    $headers = [
+      'Content-Type' => ['text/html'],
+    ];
+    $body = Json::encode([
+      'version' => '1.0',
+      'type' => 'video',
+      'html' => 'test',
+    ]);
+    $valid_response = new Response(200, $headers, $body);
+    // Strip off the trailing '}' to produce a response that will cause a JSON
+    // parse error.
+    $invalid_response = new Response(200, $headers, rtrim($body, '}'));
+    // A response that is valid JSON, but does not decode to an array, should
+    // produce an exception as well.
+    $non_array_response = new Response(200, $headers, '"Valid JSON, but not an array..."');
+
+    $mock_handler = new MockHandler([
+      $valid_response,
+      $invalid_response,
+      $non_array_response,
+    ]);
+    $client = new Client([
+      'handler' => HandlerStack::create($mock_handler),
+    ]);
+    $providers = $this->createMock('\Drupal\media\OEmbed\ProviderRepositoryInterface');
+
+    $fetcher = new ResourceFetcher($client, $providers);
+    /** @var \Drupal\media\OEmbed\Resource $resource */
+    $resource = $fetcher->fetchResource('valid');
+    // The resource should have been successfully decoded as JSON.
+    $this->assertSame('video', $resource->getType());
+    $this->assertSame('test', $resource->getHtml());
+
+    // Invalid JSON should throw an exception.
+    try {
+      $fetcher->fetchResource('invalid');
+      $this->fail('Expected a ResourceException to be thrown for invalid JSON.');
+    }
+    catch (ResourceException $e) {
+      $this->assertSame('Error decoding oEmbed resource: Syntax error', $e->getMessage());
+    }
+
+    // Valid JSON that does not produce an array should also throw an exception.
+    $this->expectException(ResourceException::class);
+    $this->expectExceptionMessage('The oEmbed resource could not be decoded.');
+    $fetcher->fetchResource('non_array');
+  }
+
+}