31a8f887a5
* bump version * fix formatting locale reset after embedded controller sub-requests (#5944) * fix GHSA-c6w6-57jj-62vh * fix GHSA-m492-gv72-xvxj * fix GHSA-jr9p-4h4j-6c58 * make sure to only use JS logic to call API endpoints * fixes GHSA-r8vr-m544-qh4h * make sure to only use JS logic to call API endpoints * fix GHSA-rw46-qg69-vg6h * fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown * fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images * fix GHSA-xv4r-4885-gwpg * fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF * fix tooltip survives page reload * updated wizard images * split wizard and password reset subscriber into two classes * relax upper php limit * added zizmor workflow scans and apply findings * user permissions <name>_other_profile now respect teams * move all linting steps to new job * updated docker image version names * use .env.local for storing APP_SECRET * improve build order and use given tag as ref for checkout, not default main branch * improved APP_SECRET handling, see entrypoint.sh * use local code for building the image for more flexibility, added dockerignore
62 lines
1.7 KiB
PHP
62 lines
1.7 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of the Kimai time-tracking app.
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace App\Tests\Utils;
|
|
|
|
use App\Utils\Parsedown;
|
|
use App\Utils\ParsedownExtension;
|
|
use PHPUnit\Framework\Attributes\CoversClass;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
#[CoversClass(Parsedown::class)]
|
|
#[CoversClass(ParsedownExtension::class)]
|
|
class ParsedownExtensionTest extends TestCase
|
|
{
|
|
public function testTableContainsCssClasses(): void
|
|
{
|
|
$sut = new ParsedownExtension();
|
|
$html = $sut->text('
|
|
| Item | Price |
|
|
|---|---|
|
|
| Something | $ 472,78 |
|
|
| Another entry | € 111 |
|
|
| | |
|
|
| Total | A lot |');
|
|
self::assertStringStartsWith('<table class="table table-striped table-vcenter">', $html);
|
|
}
|
|
|
|
public function testHeaderIsNotConverted(): void
|
|
{
|
|
$sut = new ParsedownExtension();
|
|
$html = $sut->text('
|
|
# Foo
|
|
');
|
|
self::assertEquals('<p># Foo</p>', $html);
|
|
}
|
|
|
|
/**
|
|
* Markdown image syntax must never emit an `<img>` tag, otherwise mPDF
|
|
* (server-side) or the browser (UI) would auto-fetch the remote URL.
|
|
*
|
|
* @see https://github.com/kimai/kimai/security/advisories/GHSA-pj8j-p4g4-4vw8
|
|
*/
|
|
public function testMarkdownImageIsRewrittenAsLink(): void
|
|
{
|
|
$sut = new ParsedownExtension();
|
|
$sut->setSafeMode(true);
|
|
$sut->setMarkupEscaped(true);
|
|
|
|
$html = $sut->text('');
|
|
|
|
self::assertStringNotContainsString('<img', $html);
|
|
self::assertStringContainsString('href="http://attacker.example/p.png"', $html);
|
|
self::assertStringContainsString('>probe</a>', $html);
|
|
}
|
|
}
|