Release 2.58 (#5952)

* bump version * fix formatting locale reset after embedded controller sub-requests (#5944) * fix GHSA-c6w6-57jj-62vh * fix GHSA-m492-gv72-xvxj * fix GHSA-jr9p-4h4j-6c58 * make sure to only use JS logic to call API endpoints * fixes GHSA-r8vr-m544-qh4h * make sure to only use JS logic to call API endpoints * fix GHSA-rw46-qg69-vg6h * fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown * fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images * fix GHSA-xv4r-4885-gwpg * fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF * fix tooltip survives page reload * updated wizard images * split wizard and password reset subscriber into two classes * relax upper php limit * added zizmor workflow scans and apply findings * user permissions <name>_other_profile now respect teams * move all linting steps to new job * updated docker image version names * use .env.local for storing APP_SECRET * improve build order and use given tag as ref for checkout, not default main branch * improved APP_SECRET handling, see entrypoint.sh * use local code for building the image for more flexibility, added dockerignore
2026-05-25 15:39:47 +02:00
parent 8d245ae223
commit 31a8f887a5
85 changed files with 2737 additions and 472 deletions
--- a/tests/Pdf/SafeRemoteContentClientTest.php
+++ b/tests/Pdf/SafeRemoteContentClientTest.php
@@ -0,0 +1,77 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Pdf;
+
+use App\Pdf\SafeRemoteContentClient;
+use Mpdf\PsrHttpMessageShim\Request;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpClient\Exception\TransportException;
+use Symfony\Component\HttpClient\MockHttpClient;
+use Symfony\Component\HttpClient\NoPrivateNetworkHttpClient;
+use Symfony\Component\HttpClient\Response\MockResponse;
+
+#[CoversClass(SafeRemoteContentClient::class)]
+class SafeRemoteContentClientTest extends TestCase
+{
+    public function testSuccessfulResponseIsForwarded(): void
+    {
+        $client = new MockHttpClient(
+            new MockResponse('image-bytes', ['http_code' => 200])
+        );
+
+        $sut = new SafeRemoteContentClient($client);
+        $response = $sut->sendRequest(new Request('GET', 'https://example.com/logo.png'));
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame('image-bytes', $response->getBody()->getContents());
+    }
+
+    public function testNon2xxResponseIsForwardedWithoutThrowing(): void
+    {
+        $client = new MockHttpClient(
+            new MockResponse('not found', ['http_code' => 404])
+        );
+
+        $sut = new SafeRemoteContentClient($client);
+        $response = $sut->sendRequest(new Request('GET', 'https://example.com/missing.png'));
+
+        self::assertSame(404, $response->getStatusCode());
+    }
+
+    public function testTransportExceptionResultsInNon2xxResponse(): void
+    {
+        // Simulates NoPrivateNetworkHttpClient blocking the request, a DNS
+        // failure, or a connection timeout — none of which must crash the
+        // PDF rendering pipeline.
+        $client = new MockHttpClient(static function (): MockResponse {
+            throw new TransportException('IP blocked');
+        });
+
+        $sut = new SafeRemoteContentClient($client);
+        $response = $sut->sendRequest(new Request('GET', 'http://127.0.0.1/internal'));
+
+        self::assertSame(502, $response->getStatusCode());
+    }
+
+    public function testRequestIsBlockedWhenWrappedWithNoPrivateNetworkHttpClient(): void
+    {
+        // Wraps a mock client that would otherwise succeed. The decorator
+        // must reject the localhost URL before any request is dispatched.
+        $inner = new MockHttpClient(new MockResponse('should-not-be-reached'));
+        $safe = new NoPrivateNetworkHttpClient($inner);
+
+        $sut = new SafeRemoteContentClient($safe);
+        $response = $sut->sendRequest(new Request('GET', 'http://127.0.0.1/internal'));
+
+        self::assertSame(502, $response->getStatusCode());
+        self::assertSame('', $response->getBody()->getContents());
+    }
+}