Issue #3202145 by kuldeep_mehra27, phenaproxima, bkosborne, Chris Burge:...

Issue #3202145 by kuldeep_mehra27, phenaproxima, bkosborne, Chris Burge: oEmbed resource fetcher needs to set a reasonable connection timeout

core/modules/media/src/OEmbed/ResourceFetcher.php

@@ -6,6 +6,7 @@
 use Drupal\Core\Cache\CacheBackendInterface;
 use GuzzleHttp\ClientInterface;
 use GuzzleHttp\Exception\TransferException;
+use GuzzleHttp\RequestOptions;
 
 /**
  * Fetches and caches oEmbed resources.
@@ -65,7 +66,9 @@ public function fetchResource($url) {
     }
 
     try {
-      $response = $this->httpClient->get($url);
+      $response = $this->httpClient->request('GET', $url, [
+        RequestOptions::TIMEOUT => 5,
+      ]);
     }
     catch (TransferException $e) {
       throw new ResourceException('Could not retrieve the oEmbed resource.', $url, [], $e);

core/modules/media/tests/src/Unit/ResourceFetcherTest.php

@@ -11,6 +11,7 @@
 use GuzzleHttp\Handler\MockHandler;
 use GuzzleHttp\HandlerStack;
 use GuzzleHttp\Psr7\Response;
+use GuzzleHttp\RequestOptions;
 
 /**
  * @group media
@@ -19,6 +20,34 @@
  */
 class ResourceFetcherTest extends UnitTestCase {
 
+  /**
+   * Tests that resources are fetched with a hard-coded timeout.
+   */
+  public function testFetchTimeout(): void {
+    $url = 'https://example.com/oembed?url=resource';
+    $headers = [
+      'Content-Type' => ['text/javascript'],
+    ];
+    $body = Json::encode([
+      'version' => '1.0',
+      'type' => 'video',
+      'html' => 'test',
+    ]);
+    $response = new Response(200, $headers, $body);
+
+    $client = $this->prophesize(Client::class);
+    $client->request('GET', $url, [RequestOptions::TIMEOUT => 5])
+      ->shouldBeCalled()
+      ->willReturn($response);
+
+    $fetcher = new ResourceFetcher(
+      $client->reveal(),
+      $this->createMock('\Drupal\media\OEmbed\ProviderRepositoryInterface'),
+      new NullBackend('default')
+    );
+    $fetcher->fetchResource($url);
+  }
+
   /**
    * Tests how the resource fetcher handles unknown Content-Type headers.
    *