[TASK] Allow transport_spool_filepath outside project root

The `transport_spool_filepath` setting used for the mailer's
file spool now accepts paths outside the project root.
Those paths must be configured as absolute paths and added in
`$GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath']`.

Resolves: #103159
Releases: main, 13.4
Change-Id: I46e315148d6e50625b155678d77691430dc07e8f
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83044
Tested-by: core-ci <typo3@b13.com>
Tested-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Stephan Großberndt <stephan.grossberndt@typo3.org>
Tested-by: Garvin Hicking <gh@faktor-e.de>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Garvin Hicking <gh@faktor-e.de>
Tested-by: Stephan Großberndt <stephan.grossberndt@typo3.org>

Author: eliashaeussler

typo3/sysext/core/Classes/Mail/TransportFactory.php

@@ -194,7 +194,10 @@ protected function createSpool(array $mailSettings): DelayedTransportInterface
         $transportSpoolType = (string)($mailSettings['transport_spool_type'] ?? '');
         switch ($transportSpoolType) {
             case self::SPOOL_FILE:
-                $path = GeneralUtility::getFileAbsFileName($mailSettings['transport_spool_filepath'] ?? '');
+                $path = $mailSettings['transport_spool_filepath'] ?? '';
+                if (!GeneralUtility::isAllowedAbsPath($path)) {
+                    $path = GeneralUtility::getFileAbsFileName($path);
+                }
                 if (empty($path)) {
                     throw new \RuntimeException('The Spool Type filepath must be configured for TYPO3 in order to be used. Be sure that it\'s not accessible via the web.', 1518558797);
                 }

typo3/sysext/core/Tests/Unit/Mail/TransportFactoryTest.php

@@ -17,6 +17,7 @@
 
 namespace TYPO3\CMS\Core\Tests\Unit\Mail;
 
+use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\Attributes\DoesNotPerformAssertions;
 use PHPUnit\Framework\Attributes\Test;
 use Psr\Log\NullLogger;
@@ -51,8 +52,22 @@ protected function getSubject(&$eventDispatcher): TransportFactory
         return new TransportFactory($eventDispatcher, $logManager, $logger, new FileNameValidator());
     }
 
+    /**
+     * @return \Generator<string, array{string, string, list<string>}>
+     */
+    public static function getReturnsSpoolTransportUsingFileSpoolDataProvider(): \Generator
+    {
+        yield 'relative path' => ['foo', Environment::getPublicPath() . '/foo', []];
+        yield 'extension path' => ['EXT:styleguide/Resources/Private/MailQueue', Environment::getFrameworkBasePath() . '/styleguide/Resources/Private/MailQueue', []];
+        yield 'absolute path' => ['/var/mailqueue', '/var/mailqueue', ['/var/mailqueue']];
+    }
+
+    /**
+     * @param list<string> $lockRootPath
+     */
+    #[DataProvider('getReturnsSpoolTransportUsingFileSpoolDataProvider')]
     #[Test]
-    public function getReturnsSpoolTransportUsingFileSpool(): void
+    public function getReturnsSpoolTransportUsingFileSpool(string $path, string $expected, array $lockRootPath): void
     {
         $mailSettings = [
             'transport' => 'sendmail',
@@ -69,18 +84,62 @@ public function getReturnsSpoolTransportUsingFileSpool(): void
             'defaultMailFromAddress' => '',
             'defaultMailFromName' => '',
             'transport_spool_type' => 'file',
-            'transport_spool_filepath' => '.',
+            'transport_spool_filepath' => $path,
         ];
 
+        // Register lock root path
+        $initialLockRootPath = $GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath'] ?? [];
+        $GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath'] = $lockRootPath;
+
         // Register fixture class
         $GLOBALS['TYPO3_CONF_VARS']['SYS']['Objects'][FileSpool::class]['className'] = FakeFileSpoolFixture::class;
 
         $transport = $this->getSubject($eventDispatcher)->get($mailSettings);
+
         self::assertInstanceOf(DelayedTransportInterface::class, $transport);
         self::assertInstanceOf(FakeFileSpoolFixture::class, $transport);
+        self::assertStringContainsString($expected, $transport->getPath());
+
+        // Restore lock root path
+        $GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath'] = $initialLockRootPath;
+    }
+
+    /**
+     * @return \Generator<string, array{string}>
+     */
+    public static function getThrowsExceptionOnInvalidSpoolFilePathDataProvider(): \Generator
+    {
+        yield 'relative path' => ['../foo'];
+        yield 'extension path' => ['EXT:styleguide/../foo'];
+        yield 'absolute path' => ['/foo/../baz'];
+    }
 
-        $path = $transport->getPath();
-        self::assertStringContainsString($mailSettings['transport_spool_filepath'], $path);
+    #[DataProvider('getThrowsExceptionOnInvalidSpoolFilePathDataProvider')]
+    #[Test]
+    public function getThrowsExceptionOnInvalidSpoolFilePath(string $path): void
+    {
+        $mailSettings = [
+            'transport' => 'sendmail',
+            'transport_smtp_server' => 'localhost:25',
+            'transport_smtp_encrypt' => '',
+            'transport_smtp_username' => '',
+            'transport_smtp_password' => '',
+            'transport_smtp_restart_threshold' => 0,
+            'transport_smtp_restart_threshold_sleep' => 0,
+            'transport_smtp_ping_threshold' => 0,
+            'transport_smtp_stream_options' => [],
+            'transport_sendmail_command' => '',
+            'transport_mbox_file' => '',
+            'defaultMailFromAddress' => '',
+            'defaultMailFromName' => '',
+            'transport_spool_type' => 'file',
+            'transport_spool_filepath' => $path,
+        ];
+
+        $this->expectException(\RuntimeException::class);
+        $this->expectExceptionCode(1518558797);
+
+        $this->getSubject($eventDispatcher)->get($mailSettings);
     }
 
     #[Test]