From abe033be855f76fde9e8576ce36460fbb23b1e57 Mon Sep 17 00:00:00 2001 From: ArthurHoaro Date: Tue, 22 Sep 2020 15:17:13 +0200 Subject: Fix invalid redirection using the path of an external domain Fixes #1554 --- .../visitor/PublicSessionFilterControllerTest.php | 6 +-- .../visitor/ShaarliVisitorControllerTest.php | 45 ++++++++++++++++++---- 2 files changed, 41 insertions(+), 10 deletions(-) (limited to 'tests/front/controller/visitor') diff --git a/tests/front/controller/visitor/PublicSessionFilterControllerTest.php b/tests/front/controller/visitor/PublicSessionFilterControllerTest.php index 06352750..b45fbe53 100644 --- a/tests/front/controller/visitor/PublicSessionFilterControllerTest.php +++ b/tests/front/controller/visitor/PublicSessionFilterControllerTest.php @@ -28,7 +28,7 @@ class PublicSessionFilterControllerTest extends TestCase */ public function testLinksPerPage(): void { - $this->container->environment = ['HTTP_REFERER' => 'http://shaarli/subfolder/controller/?searchtag=abc']; + $this->container->environment['HTTP_REFERER'] = 'http://shaarli/subfolder/controller/?searchtag=abc'; $request = $this->createMock(Request::class); $request->method('getParam')->with('nb')->willReturn('8'); @@ -74,7 +74,7 @@ class PublicSessionFilterControllerTest extends TestCase */ public function testUntaggedOnly(): void { - $this->container->environment = ['HTTP_REFERER' => 'http://shaarli/subfolder/controller/?searchtag=abc']; + $this->container->environment['HTTP_REFERER'] = 'http://shaarli/subfolder/controller/?searchtag=abc'; $request = $this->createMock(Request::class); $response = new Response(); @@ -97,7 +97,7 @@ class PublicSessionFilterControllerTest extends TestCase */ public function testUntaggedOnlyToggleOff(): void { - $this->container->environment = ['HTTP_REFERER' => 'http://shaarli/subfolder/controller/?searchtag=abc']; + $this->container->environment['HTTP_REFERER'] = 'http://shaarli/subfolder/controller/?searchtag=abc'; $request = $this->createMock(Request::class); $response = new Response(); diff --git a/tests/front/controller/visitor/ShaarliVisitorControllerTest.php b/tests/front/controller/visitor/ShaarliVisitorControllerTest.php index 316ce49c..00188c02 100644 --- a/tests/front/controller/visitor/ShaarliVisitorControllerTest.php +++ b/tests/front/controller/visitor/ShaarliVisitorControllerTest.php @@ -110,7 +110,7 @@ class ShaarliVisitorControllerTest extends TestCase */ public function testRedirectFromRefererDefault(): void { - $this->container->environment['HTTP_REFERER'] = 'http://shaarli.tld/subfolder/controller?query=param&other=2'; + $this->container->environment['HTTP_REFERER'] = 'http://shaarli/subfolder/controller?query=param&other=2'; $response = new Response(); @@ -125,7 +125,7 @@ class ShaarliVisitorControllerTest extends TestCase */ public function testRedirectFromRefererWithUnmatchedLoopTerm(): void { - $this->container->environment['HTTP_REFERER'] = 'http://shaarli.tld/subfolder/controller?query=param&other=2'; + $this->container->environment['HTTP_REFERER'] = 'http://shaarli/subfolder/controller?query=param&other=2'; $response = new Response(); @@ -140,7 +140,7 @@ class ShaarliVisitorControllerTest extends TestCase */ public function testRedirectFromRefererWithMatchingLoopTermInPath(): void { - $this->container->environment['HTTP_REFERER'] = 'http://shaarli.tld/subfolder/controller?query=param&other=2'; + $this->container->environment['HTTP_REFERER'] = 'http://shaarli/subfolder/controller?query=param&other=2'; $response = new Response(); @@ -155,7 +155,7 @@ class ShaarliVisitorControllerTest extends TestCase */ public function testRedirectFromRefererWithMatchingLoopTermInQueryParam(): void { - $this->container->environment['HTTP_REFERER'] = 'http://shaarli.tld/subfolder/controller?query=param&other=2'; + $this->container->environment['HTTP_REFERER'] = 'http://shaarli/subfolder/controller?query=param&other=2'; $response = new Response(); @@ -171,7 +171,7 @@ class ShaarliVisitorControllerTest extends TestCase */ public function testRedirectFromRefererWithMatchingLoopTermInQueryValue(): void { - $this->container->environment['HTTP_REFERER'] = 'http://shaarli.tld/subfolder/controller?query=param&other=2'; + $this->container->environment['HTTP_REFERER'] = 'http://shaarli/subfolder/controller?query=param&other=2'; $response = new Response(); @@ -187,7 +187,7 @@ class ShaarliVisitorControllerTest extends TestCase */ public function testRedirectFromRefererWithLoopTermInDomain(): void { - $this->container->environment['HTTP_REFERER'] = 'http://shaarli.tld/subfolder/controller?query=param&other=2'; + $this->container->environment['HTTP_REFERER'] = 'http://shaarli/subfolder/controller?query=param&other=2'; $response = new Response(); @@ -203,7 +203,7 @@ class ShaarliVisitorControllerTest extends TestCase */ public function testRedirectFromRefererWithMatchingClearedParam(): void { - $this->container->environment['HTTP_REFERER'] = 'http://shaarli.tld/subfolder/controller?query=param&other=2'; + $this->container->environment['HTTP_REFERER'] = 'http://shaarli/subfolder/controller?query=param&other=2'; $response = new Response(); @@ -212,4 +212,35 @@ class ShaarliVisitorControllerTest extends TestCase static::assertSame(302, $result->getStatusCode()); static::assertSame(['/subfolder/controller?other=2'], $result->getHeader('location')); } + + /** + * Test redirectFromReferer() - From another domain -> we ignore the given referrer. + */ + public function testRedirectExternalReferer(): void + { + $this->container->environment['HTTP_REFERER'] = 'http://other.domain.tld/controller?query=param&other=2'; + + $response = new Response(); + + $result = $this->controller->redirectFromReferer($this->request, $response, ['query'], ['query']); + + static::assertSame(302, $result->getStatusCode()); + static::assertSame(['/subfolder/'], $result->getHeader('location')); + } + + /** + * Test redirectFromReferer() - From another domain -> we ignore the given referrer. + */ + public function testRedirectExternalRefererExplicitDomainName(): void + { + $this->container->environment['SERVER_NAME'] = 'my.shaarli.tld'; + $this->container->environment['HTTP_REFERER'] = 'http://your.shaarli.tld/controller?query=param&other=2'; + + $response = new Response(); + + $result = $this->controller->redirectFromReferer($this->request, $response, ['query'], ['query']); + + static::assertSame(302, $result->getStatusCode()); + static::assertSame(['/subfolder/'], $result->getHeader('location')); + } } -- cgit v1.2.3