100 lines
3.7 KiB
PHP
100 lines
3.7 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of the Kimai time-tracking app.
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace App\Tests\Twig\SecurityPolicy;
|
|
|
|
use App\Entity\User;
|
|
use App\Pdf\PdfContext;
|
|
use App\Twig\SecurityPolicy\StrictPolicy;
|
|
use PHPUnit\Framework\Attributes\CoversClass;
|
|
use PHPUnit\Framework\Attributes\DataProvider;
|
|
use PHPUnit\Framework\TestCase;
|
|
use Symfony\Bridge\Twig\AppVariable;
|
|
use Symfony\Component\HttpFoundation\Request;
|
|
use Symfony\Component\HttpFoundation\ServerBag;
|
|
use Symfony\Component\HttpFoundation\Session\SessionInterface;
|
|
use Symfony\Component\String\UnicodeString;
|
|
use Twig\Sandbox\SecurityNotAllowedMethodError;
|
|
use Twig\Sandbox\SecurityPolicyInterface;
|
|
|
|
#[CoversClass(StrictPolicy::class)]
|
|
class StrictPolicyTestCase extends TestCase
|
|
{
|
|
private function createPolicy(): SecurityPolicyInterface
|
|
{
|
|
return new StrictPolicy();
|
|
}
|
|
|
|
public function testCheckSecurity(): void
|
|
{
|
|
$sut = $this->createPolicy();
|
|
$sut->checkSecurity([], [], []);
|
|
$this->expectNotToPerformAssertions();
|
|
}
|
|
|
|
public function testCheckPropertyAllowed(): void
|
|
{
|
|
$sut = $this->createPolicy();
|
|
$sut->checkPropertyAllowed(new \stdClass(), 'foo');
|
|
$this->expectNotToPerformAssertions();
|
|
}
|
|
|
|
#[DataProvider('getCheckMethodAllowedData')]
|
|
public function testCheckMethodAllowed(object $obj, string $method, ?string $expectedExceptionMessage = null): void
|
|
{
|
|
$sut = $this->createPolicy();
|
|
|
|
if ($expectedExceptionMessage !== null) {
|
|
$this->expectException(SecurityNotAllowedMethodError::class);
|
|
$this->expectExceptionMessage($expectedExceptionMessage);
|
|
}
|
|
|
|
$sut->checkMethodAllowed($obj, $method);
|
|
|
|
if ($expectedExceptionMessage === null) {
|
|
$this->expectNotToPerformAssertions();
|
|
}
|
|
}
|
|
|
|
public static function getCheckMethodAllowedData(): array
|
|
{
|
|
return [
|
|
[new ServerBag(), 'get', 'Tried to access server environment'],
|
|
[self::createStub(SessionInterface::class), 'getId', 'Tried to access session'],
|
|
[new \stdClass(), 'foo', 'Tried to access non-read method'],
|
|
[new \stdClass(), 'setFoo', 'Tried to access non-read method'],
|
|
[new \stdClass(), 'getFoo'],
|
|
[new \stdClass(), 'hasFoo'],
|
|
[new \stdClass(), 'isFoo'],
|
|
[new UnicodeString(), '__toString'],
|
|
// Request
|
|
[new Request(), 'get', null],
|
|
[new Request(), 'isXmlHttpRequest', 'Tried to call setter() of app variable'],
|
|
[new Request(), 'hasSession', 'Tried to call setter() of app variable'],
|
|
// PdfContext
|
|
[new PdfContext(), 'setOption'],
|
|
[new PdfContext(), 'getOption', 'Tried to access forbidden method on PdfContext'],
|
|
// AppVariable
|
|
[new AppVariable(), 'getRequest'],
|
|
[new AppVariable(), 'getUser'],
|
|
[new AppVariable(), 'getLocale'],
|
|
[new AppVariable(), 'getCharset', 'Tried to access forbidden app variable method'],
|
|
// User
|
|
[new User(), 'getUsername'],
|
|
[new User(), 'getPassword', 'Tried to access user secrets'],
|
|
[new User(), 'getTotpSecret', 'Tried to access user secrets'],
|
|
[new User(), 'getPlainPassword', 'Tried to access user secrets'],
|
|
[new User(), 'getConfirmationToken', 'Tried to access user secrets'],
|
|
[new User(), 'getTotpAuthenticationConfiguration', 'Tried to access user secrets'],
|
|
[new User(), 'getPlainApiToken', 'Tried to access user secrets'],
|
|
[new User(), 'getApiToken', 'Tried to access user secrets'],
|
|
];
|
|
}
|
|
}
|