Twig config improvements (#5923)

* deprecate direct kimai_config access, which was only used internally
* prevent access to system configs
* prevent access to most configs in sandbox environments

tests/Twig/ConfigurationTest.php

@@ -0,0 +1,193 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Twig;
+
+use App\Constants;
+use App\Tests\Mocks\SystemConfigurationFactory;
+use App\Twig\Configuration;
+use App\Twig\SecurityPolicy\StrictPolicy;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use Twig\Environment;
+use Twig\Extension\SandboxExtension;
+use Twig\Loader\ArrayLoader;
+use Twig\Sandbox\SecurityError;
+use Twig\TwigFunction;
+
+#[CoversClass(Configuration::class)]
+class ConfigurationTest extends TestCase
+{
+    private function createEnvironment(array $templates = ['template' => ''], bool $sandboxed = false): Environment
+    {
+        $environment = new Environment(new ArrayLoader($templates));
+
+        if ($sandboxed) {
+            $sandbox = new SandboxExtension(new StrictPolicy());
+            $environment->addExtension($sandbox);
+            $sandbox->enableSandbox();
+        }
+
+        return $environment;
+    }
+
+    private function createExtension(array $settings = []): Configuration
+    {
+        return new Configuration(SystemConfigurationFactory::createStub($settings));
+    }
+
+    private function getDefaultSettings(): array
+    {
+        return [
+            'theme' => [
+                'show_about' => true,
+                'avatar_url' => true,
+                'branding' => [
+                    'logo' => 'logo.png',
+                    'company' => 'Acme Inc.',
+                ],
+            ],
+            'user' => [
+                'login' => false,
+                'password_reset' => true,
+                'password_reset_token_ttl' => 3600,
+            ],
+            'ldap' => [
+                'activate' => false,
+            ],
+            'saml' => [
+                'activate' => false,
+                'title' => 'SAML Login',
+            ],
+        ];
+    }
+
+    public function testGetFunctions(): void
+    {
+        $sut = $this->createExtension($this->getDefaultSettings());
+
+        $functions = $sut->getFunctions();
+
+        self::assertCount(1, $functions);
+        self::assertInstanceOf(TwigFunction::class, $functions[0]);
+        self::assertSame('config', $functions[0]->getName());
+
+        $environment = $this->createEnvironment(['template' => '{{ config(\'theme.branding.company\') }}']);
+        $environment->addExtension($sut);
+
+        self::assertSame('Acme Inc.', $environment->render('template'));
+    }
+
+    public static function provideFixedConfigValues(): iterable
+    {
+        yield 'chart class' => ['chart-class', ''];
+        yield 'chart background' => ['theme.chart.background_color', '#3c8dbc'];
+        yield 'chart border' => ['theme.chart.border_color', '#3b8bba'];
+        yield 'chart grid' => ['theme.chart.grid_color', 'rgba(0,0,0,.05)'];
+        yield 'chart height' => ['theme.chart.height', '300'];
+        yield 'calendar background' => ['theme.calendar.background_color', Constants::DEFAULT_COLOR];
+    }
+
+    #[DataProvider('provideFixedConfigValues')]
+    public function testReturnsFixedConfigValues(string $name, string $expected): void
+    {
+        $sut = $this->createExtension();
+
+        self::assertSame($expected, $sut->get($this->createEnvironment(), $name));
+    }
+
+    public static function provideSandboxAllowedTemplates(): iterable
+    {
+        yield 'avatar urls' => ['{{ config(\'themeAllowAvatarUrls\') ? \'1\' : \'0\' }}', '1'];
+        yield 'branding logo' => ['{{ config(\'theme.branding.logo\') }}', 'logo.png'];
+        yield 'branding company' => ['{{ config(\'theme.branding.company\') }}', 'Acme Inc.'];
+    }
+
+    #[DataProvider('provideSandboxAllowedTemplates')]
+    public function testSandboxAllowsWhitelistedConfigAccess(string $template, string $expected): void
+    {
+        $environment = $this->createEnvironment(['template' => $template], true);
+        $environment->addExtension($this->createExtension($this->getDefaultSettings()));
+
+        self::assertSame($expected, $environment->render('template'));
+    }
+
+    public static function provideSensitiveConfigKeys(): iterable
+    {
+        yield 'saml active' => ['saml.activate'];
+        yield 'saml title' => ['saml.title'];
+        yield 'ldap active' => ['ldap.activate'];
+        yield 'ldap connection' => ['ldap.connection.host'];
+    }
+
+    #[DataProvider('provideSensitiveConfigKeys')]
+    public function testRejectsSensitiveConfigKeys(string $name): void
+    {
+        $sut = $this->createExtension($this->getDefaultSettings());
+
+        $this->expectException(SecurityError::class);
+        $this->expectExceptionMessage(\sprintf('Templates cannot access security configuration %s.', $name));
+
+        $sut->get($this->createEnvironment([], true), $name);
+    }
+
+    public function testSandboxRejectsNonWhitelistedConfigAccess(): void
+    {
+        $environment = $this->createEnvironment(['template' => '{{ config(\'showAbout\') ? \'1\' : \'0\' }}'], true);
+        $environment->addExtension($this->createExtension($this->getDefaultSettings()));
+
+        $this->expectException(SecurityError::class);
+        $this->expectExceptionMessage('Sandboxed template tried to access configuration key: showAbout');
+
+        $environment->render('template');
+    }
+
+    public function testUsesIsAccessorOutsideSandbox(): void
+    {
+        $sut = $this->createExtension($this->getDefaultSettings());
+
+        self::assertTrue($sut->get($this->createEnvironment(), 'showAbout'));
+        self::assertTrue($sut->get($this->createEnvironment(), 'loginFormActive'));
+    }
+
+    public function testUsesGetAccessorOutsideSandbox(): void
+    {
+        $sut = $this->createExtension($this->getDefaultSettings());
+
+        self::assertSame(3600, $sut->get($this->createEnvironment(), 'passwordResetTokenLifetime'));
+    }
+
+    public function testFallsBackToFindOutsideSandbox(): void
+    {
+        $sut = $this->createExtension($this->getDefaultSettings());
+        $environment = $this->createEnvironment();
+
+        self::assertTrue($sut->get($environment, 'theme.show_about'));
+        self::assertNull($sut->get($environment, 'does.not.exist'));
+    }
+
+    public function testDeprecatedKimaiConfigAccessAlwaysReturnsNull(): void
+    {
+        $sut = $this->createExtension($this->getDefaultSettings());
+
+        $previousHandler = set_error_handler(static function (int $type, string $message): true {
+            self::assertSame(E_USER_DEPRECATED, $type);
+            self::assertSame('Accessing "kimai_config" is deprecated and always return null, use config() instead', $message);
+
+            return true;
+        });
+
+        try {
+            self::assertNull($sut->__call('legacyAccess', []));
+        } finally {
+            restore_error_handler();
+        }
+    }
+}

tests/Twig/ContextTest.php

@@ -10,8 +10,6 @@
 namespace App\Tests\Twig;
 
 use App\Configuration\SystemConfiguration;
-use App\Tests\Configuration\TestConfigLoader;
-use App\Tests\Mocks\SystemConfigurationFactory;
 use App\Twig\Context;
 use PHPUnit\Framework\Attributes\CoversClass;
 use PHPUnit\Framework\TestCase;
@@ -24,9 +22,6 @@ class ContextTest extends TestCase
 {
     protected function getSut(array $settings, array $headers = []): Context
     {
-        $loader = new TestConfigLoader([]);
-        $config = SystemConfigurationFactory::create($loader, ['theme' => $settings]);
-
         $stack = new RequestStack();
         $request = new Request();
         foreach ($headers as $name => $value) {
@@ -34,13 +29,13 @@ class ContextTest extends TestCase
         }
         $stack->push($request);
 
-        return new Context($config, $stack);
+        return new Context($stack);
     }
 
     /**
-     * @return array
+     * @return array<string, mixed>
      */
-    protected function getDefaultSettings()
+    protected function getDefaultSettings(): array
     {
         return [
             'show_about' => true,

tests/phpstan.neon

@@ -1996,11 +1996,6 @@ parameters:
             count: 4
             path: TranslationsTest.php
 
-        -
-            message: "#^Method App\\\\Tests\\\\Twig\\\\ContextTest\\:\\:getDefaultSettings\\(\\) return type has no value type specified in iterable type array\\.$#"
-            count: 1
-            path: Twig/ContextTest.php
-
         -
             message: "#^Method App\\\\Tests\\\\Twig\\\\ContextTest\\:\\:getSut\\(\\) has parameter \\$headers with no value type specified in iterable type array\\.$#"
             count: 1