1 files changed, 131 insertions, 0 deletions

diff --git a/tests/front/controller/ShaarliControllerTest.php b/tests/front/controller/ShaarliControllerTest.php
index 3efe4d95..a6011b49 100644
--- a/tests/front/controller/ShaarliControllerTest.php
+++ b/tests/front/controller/ShaarliControllerTest.php
@@ -6,6 +6,7 @@ namespace Shaarli\Front\Controller;
 
 use PHPUnit\Framework\TestCase;
 use Shaarli\Bookmark\BookmarkFilter;
+use Slim\Http\Response;
 
 /**
  * Class ShaarliControllerTest
@@ -38,6 +39,14 @@ class ShaarliControllerTest extends TestCase
             {
                 return parent::render($template);
             }
+
+            public function redirectFromReferer(
+                Response $response,
+                array $loopTerms = [],
+                array $clearParams = []
+            ): Response {
+                return parent::redirectFromReferer($response, $loopTerms, $clearParams);
+            }
         };
         $this->assignedValues = [];
     }
@@ -91,4 +100,126 @@ class ShaarliControllerTest extends TestCase
         static::assertSame('templateName', $this->assignedValues['plugins_footer']['render_footer']['target']);
         static::assertTrue($this->assignedValues['plugins_footer']['render_footer']['loggedin']);
     }
+
+    /**
+     * Test redirectFromReferer() - Default behaviour
+     */
+    public function testRedirectFromRefererDefault(): void
+    {
+        $this->createValidContainerMockSet();
+
+        $this->container->environment['HTTP_REFERER'] = 'http://shaarli.tld/subfolder/controller?query=param&other=2';
+
+        $response = new Response();
+
+        $result = $this->controller->redirectFromReferer($response);
+
+        static::assertSame(302, $result->getStatusCode());
+        static::assertSame(['/subfolder/controller?query=param&other=2'], $result->getHeader('location'));
+    }
+
+    /**
+     * Test redirectFromReferer() - With a loop term not matched in the referer
+     */
+    public function testRedirectFromRefererWithUnmatchedLoopTerm(): void
+    {
+        $this->createValidContainerMockSet();
+
+        $this->container->environment['HTTP_REFERER'] = 'http://shaarli.tld/subfolder/controller?query=param&other=2';
+
+        $response = new Response();
+
+        $result = $this->controller->redirectFromReferer($response, ['nope']);
+
+        static::assertSame(302, $result->getStatusCode());
+        static::assertSame(['/subfolder/controller?query=param&other=2'], $result->getHeader('location'));
+    }
+
+    /**
+     * Test redirectFromReferer() - With a loop term matching the referer in its path -> redirect to default
+     */
+    public function testRedirectFromRefererWithMatchingLoopTermInPath(): void
+    {
+        $this->createValidContainerMockSet();
+
+        $this->container->environment['HTTP_REFERER'] = 'http://shaarli.tld/subfolder/controller?query=param&other=2';
+
+        $response = new Response();
+
+        $result = $this->controller->redirectFromReferer($response, ['nope', 'controller']);
+
+        static::assertSame(302, $result->getStatusCode());
+        static::assertSame(['./'], $result->getHeader('location'));
+    }
+
+    /**
+     * Test redirectFromReferer() - With a loop term matching the referer in its query parameters -> redirect to default
+     */
+    public function testRedirectFromRefererWithMatchingLoopTermInQueryParam(): void
+    {
+        $this->createValidContainerMockSet();
+
+        $this->container->environment['HTTP_REFERER'] = 'http://shaarli.tld/subfolder/controller?query=param&other=2';
+
+        $response = new Response();
+
+        $result = $this->controller->redirectFromReferer($response, ['nope', 'other']);
+
+        static::assertSame(302, $result->getStatusCode());
+        static::assertSame(['./'], $result->getHeader('location'));
+    }
+
+    /**
+     * Test redirectFromReferer() - With a loop term matching the referer in its query value
+     *                              -> we do not block redirection for query parameter values.
+     */
+    public function testRedirectFromRefererWithMatchingLoopTermInQueryValue(): void
+    {
+        $this->createValidContainerMockSet();
+
+        $this->container->environment['HTTP_REFERER'] = 'http://shaarli.tld/subfolder/controller?query=param&other=2';
+
+        $response = new Response();
+
+        $result = $this->controller->redirectFromReferer($response, ['nope', 'param']);
+
+        static::assertSame(302, $result->getStatusCode());
+        static::assertSame(['/subfolder/controller?query=param&other=2'], $result->getHeader('location'));
+    }
+
+    /**
+     * Test redirectFromReferer() - With a loop term matching the referer in its domain name
+     *                              -> we do not block redirection for shaarli's hosts
+     */
+    public function testRedirectFromRefererWithLoopTermInDomain(): void
+    {
+        $this->createValidContainerMockSet();
+
+        $this->container->environment['HTTP_REFERER'] = 'http://shaarli.tld/subfolder/controller?query=param&other=2';
+
+        $response = new Response();
+
+        $result = $this->controller->redirectFromReferer($response, ['shaarli']);
+
+        static::assertSame(302, $result->getStatusCode());
+        static::assertSame(['/subfolder/controller?query=param&other=2'], $result->getHeader('location'));
+    }
+
+    /**
+     * Test redirectFromReferer() - With a loop term matching a query parameter AND clear this query param
+     *                              -> the param should be cleared before checking if it matches the redir loop terms
+     */
+    public function testRedirectFromRefererWithMatchingClearedParam(): void
+    {
+        $this->createValidContainerMockSet();
+
+        $this->container->environment['HTTP_REFERER'] = 'http://shaarli.tld/subfolder/controller?query=param&other=2';
+
+        $response = new Response();
+
+        $result = $this->controller->redirectFromReferer($response, ['query'], ['query']);
+
+        static::assertSame(302, $result->getStatusCode());
+        static::assertSame(['/subfolder/controller?other=2'], $result->getHeader('location'));
+    }
 }