31a8f887a5
* bump version * fix formatting locale reset after embedded controller sub-requests (#5944) * fix GHSA-c6w6-57jj-62vh * fix GHSA-m492-gv72-xvxj * fix GHSA-jr9p-4h4j-6c58 * make sure to only use JS logic to call API endpoints * fixes GHSA-r8vr-m544-qh4h * make sure to only use JS logic to call API endpoints * fix GHSA-rw46-qg69-vg6h * fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown * fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images * fix GHSA-xv4r-4885-gwpg * fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF * fix tooltip survives page reload * updated wizard images * split wizard and password reset subscriber into two classes * relax upper php limit * added zizmor workflow scans and apply findings * user permissions <name>_other_profile now respect teams * move all linting steps to new job * updated docker image version names * use .env.local for storing APP_SECRET * improve build order and use given tag as ref for checkout, not default main branch * improved APP_SECRET handling, see entrypoint.sh * use local code for building the image for more flexibility, added dockerignore
78 lines
2.8 KiB
PHP
78 lines
2.8 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of the Kimai time-tracking app.
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace App\Tests\Pdf;
|
|
|
|
use App\Pdf\SafeRemoteContentClient;
|
|
use Mpdf\PsrHttpMessageShim\Request;
|
|
use PHPUnit\Framework\Attributes\CoversClass;
|
|
use PHPUnit\Framework\TestCase;
|
|
use Symfony\Component\HttpClient\Exception\TransportException;
|
|
use Symfony\Component\HttpClient\MockHttpClient;
|
|
use Symfony\Component\HttpClient\NoPrivateNetworkHttpClient;
|
|
use Symfony\Component\HttpClient\Response\MockResponse;
|
|
|
|
#[CoversClass(SafeRemoteContentClient::class)]
|
|
class SafeRemoteContentClientTest extends TestCase
|
|
{
|
|
public function testSuccessfulResponseIsForwarded(): void
|
|
{
|
|
$client = new MockHttpClient(
|
|
new MockResponse('image-bytes', ['http_code' => 200])
|
|
);
|
|
|
|
$sut = new SafeRemoteContentClient($client);
|
|
$response = $sut->sendRequest(new Request('GET', 'https://example.com/logo.png'));
|
|
|
|
self::assertSame(200, $response->getStatusCode());
|
|
self::assertSame('image-bytes', $response->getBody()->getContents());
|
|
}
|
|
|
|
public function testNon2xxResponseIsForwardedWithoutThrowing(): void
|
|
{
|
|
$client = new MockHttpClient(
|
|
new MockResponse('not found', ['http_code' => 404])
|
|
);
|
|
|
|
$sut = new SafeRemoteContentClient($client);
|
|
$response = $sut->sendRequest(new Request('GET', 'https://example.com/missing.png'));
|
|
|
|
self::assertSame(404, $response->getStatusCode());
|
|
}
|
|
|
|
public function testTransportExceptionResultsInNon2xxResponse(): void
|
|
{
|
|
// Simulates NoPrivateNetworkHttpClient blocking the request, a DNS
|
|
// failure, or a connection timeout — none of which must crash the
|
|
// PDF rendering pipeline.
|
|
$client = new MockHttpClient(static function (): MockResponse {
|
|
throw new TransportException('IP blocked');
|
|
});
|
|
|
|
$sut = new SafeRemoteContentClient($client);
|
|
$response = $sut->sendRequest(new Request('GET', 'http://127.0.0.1/internal'));
|
|
|
|
self::assertSame(502, $response->getStatusCode());
|
|
}
|
|
|
|
public function testRequestIsBlockedWhenWrappedWithNoPrivateNetworkHttpClient(): void
|
|
{
|
|
// Wraps a mock client that would otherwise succeed. The decorator
|
|
// must reject the localhost URL before any request is dispatched.
|
|
$inner = new MockHttpClient(new MockResponse('should-not-be-reached'));
|
|
$safe = new NoPrivateNetworkHttpClient($inner);
|
|
|
|
$sut = new SafeRemoteContentClient($safe);
|
|
$response = $sut->sendRequest(new Request('GET', 'http://127.0.0.1/internal'));
|
|
|
|
self::assertSame(502, $response->getStatusCode());
|
|
self::assertSame('', $response->getBody()->getContents());
|
|
}
|
|
}
|