HttpUtilsTest.php 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327
  1. <?php
  2. /*
  3. * This file is part of the Symfony package.
  4. *
  5. * (c) Fabien Potencier <fabien@symfony.com>
  6. *
  7. * For the full copyright and license information, please view the LICENSE
  8. * file that was distributed with this source code.
  9. */
  10. namespace Symfony\Component\Security\Http\Tests;
  11. use PHPUnit\Framework\TestCase;
  12. use Symfony\Component\HttpFoundation\Request;
  13. use Symfony\Component\Routing\Exception\MethodNotAllowedException;
  14. use Symfony\Component\Routing\Exception\ResourceNotFoundException;
  15. use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
  16. use Symfony\Component\Security\Core\Security;
  17. use Symfony\Component\Security\Http\HttpUtils;
  18. class HttpUtilsTest extends TestCase
  19. {
  20. public function testCreateRedirectResponseWithPath()
  21. {
  22. $utils = new HttpUtils($this->getUrlGenerator());
  23. $response = $utils->createRedirectResponse($this->getRequest(), '/foobar');
  24. $this->assertTrue($response->isRedirect('http://localhost/foobar'));
  25. $this->assertEquals(302, $response->getStatusCode());
  26. }
  27. public function testCreateRedirectResponseWithAbsoluteUrl()
  28. {
  29. $utils = new HttpUtils($this->getUrlGenerator());
  30. $response = $utils->createRedirectResponse($this->getRequest(), 'http://symfony.com/');
  31. $this->assertTrue($response->isRedirect('http://symfony.com/'));
  32. }
  33. public function testCreateRedirectResponseWithDomainRegexp()
  34. {
  35. $utils = new HttpUtils($this->getUrlGenerator(), null, '#^https?://symfony\.com$#i');
  36. $response = $utils->createRedirectResponse($this->getRequest(), 'http://symfony.com/blog');
  37. $this->assertTrue($response->isRedirect('http://symfony.com/blog'));
  38. }
  39. public function testCreateRedirectResponseWithRequestsDomain()
  40. {
  41. $utils = new HttpUtils($this->getUrlGenerator(), null, '#^https?://%s$#i');
  42. $response = $utils->createRedirectResponse($this->getRequest(), 'http://localhost/blog');
  43. $this->assertTrue($response->isRedirect('http://localhost/blog'));
  44. }
  45. /**
  46. * @dataProvider badRequestDomainUrls
  47. */
  48. public function testCreateRedirectResponseWithBadRequestsDomain($url)
  49. {
  50. $utils = new HttpUtils($this->getUrlGenerator(), null, '#^https?://%s$#i');
  51. $response = $utils->createRedirectResponse($this->getRequest(), $url);
  52. $this->assertTrue($response->isRedirect('http://localhost/'));
  53. }
  54. public function badRequestDomainUrls()
  55. {
  56. return array(
  57. array('http://pirate.net/foo'),
  58. array('http:\\\\pirate.net/foo'),
  59. array('http:/\\pirate.net/foo'),
  60. array('http:\\/pirate.net/foo'),
  61. array('http://////pirate.net/foo'),
  62. );
  63. }
  64. public function testCreateRedirectResponseWithProtocolRelativeTarget()
  65. {
  66. $utils = new HttpUtils($this->getUrlGenerator(), null, '#^https?://%s$#i');
  67. $response = $utils->createRedirectResponse($this->getRequest(), '//evil.com/do-bad-things');
  68. $this->assertTrue($response->isRedirect('http://localhost//evil.com/do-bad-things'), 'Protocol-relative redirection should not be supported for security reasons');
  69. }
  70. public function testCreateRedirectResponseWithRouteName()
  71. {
  72. $utils = new HttpUtils($urlGenerator = $this->getMockBuilder('Symfony\Component\Routing\Generator\UrlGeneratorInterface')->getMock());
  73. $urlGenerator
  74. ->expects($this->any())
  75. ->method('generate')
  76. ->with('foobar', array(), UrlGeneratorInterface::ABSOLUTE_URL)
  77. ->will($this->returnValue('http://localhost/foo/bar'))
  78. ;
  79. $urlGenerator
  80. ->expects($this->any())
  81. ->method('getContext')
  82. ->will($this->returnValue($this->getMockBuilder('Symfony\Component\Routing\RequestContext')->getMock()))
  83. ;
  84. $response = $utils->createRedirectResponse($this->getRequest(), 'foobar');
  85. $this->assertTrue($response->isRedirect('http://localhost/foo/bar'));
  86. }
  87. public function testCreateRequestWithPath()
  88. {
  89. $request = $this->getRequest();
  90. $request->server->set('Foo', 'bar');
  91. $utils = new HttpUtils($this->getUrlGenerator());
  92. $subRequest = $utils->createRequest($request, '/foobar');
  93. $this->assertEquals('GET', $subRequest->getMethod());
  94. $this->assertEquals('/foobar', $subRequest->getPathInfo());
  95. $this->assertEquals('bar', $subRequest->server->get('Foo'));
  96. }
  97. public function testCreateRequestWithRouteName()
  98. {
  99. $utils = new HttpUtils($urlGenerator = $this->getMockBuilder('Symfony\Component\Routing\Generator\UrlGeneratorInterface')->getMock());
  100. $urlGenerator
  101. ->expects($this->once())
  102. ->method('generate')
  103. ->will($this->returnValue('/foo/bar'))
  104. ;
  105. $urlGenerator
  106. ->expects($this->any())
  107. ->method('getContext')
  108. ->will($this->returnValue($this->getMockBuilder('Symfony\Component\Routing\RequestContext')->getMock()))
  109. ;
  110. $subRequest = $utils->createRequest($this->getRequest(), 'foobar');
  111. $this->assertEquals('/foo/bar', $subRequest->getPathInfo());
  112. }
  113. public function testCreateRequestWithAbsoluteUrl()
  114. {
  115. $utils = new HttpUtils($this->getMockBuilder('Symfony\Component\Routing\Generator\UrlGeneratorInterface')->getMock());
  116. $subRequest = $utils->createRequest($this->getRequest(), 'http://symfony.com/');
  117. $this->assertEquals('/', $subRequest->getPathInfo());
  118. }
  119. public function testCreateRequestPassesSessionToTheNewRequest()
  120. {
  121. $request = $this->getRequest();
  122. $request->setSession($session = $this->getMockBuilder('Symfony\Component\HttpFoundation\Session\SessionInterface')->getMock());
  123. $utils = new HttpUtils($this->getUrlGenerator());
  124. $subRequest = $utils->createRequest($request, '/foobar');
  125. $this->assertSame($session, $subRequest->getSession());
  126. }
  127. /**
  128. * @dataProvider provideSecurityContextAttributes
  129. */
  130. public function testCreateRequestPassesSecurityContextAttributesToTheNewRequest($attribute)
  131. {
  132. $request = $this->getRequest();
  133. $request->attributes->set($attribute, 'foo');
  134. $utils = new HttpUtils($this->getUrlGenerator());
  135. $subRequest = $utils->createRequest($request, '/foobar');
  136. $this->assertSame('foo', $subRequest->attributes->get($attribute));
  137. }
  138. public function provideSecurityContextAttributes()
  139. {
  140. return array(
  141. array(Security::AUTHENTICATION_ERROR),
  142. array(Security::ACCESS_DENIED_ERROR),
  143. array(Security::LAST_USERNAME),
  144. );
  145. }
  146. public function testCheckRequestPath()
  147. {
  148. $utils = new HttpUtils($this->getUrlGenerator());
  149. $this->assertTrue($utils->checkRequestPath($this->getRequest(), '/'));
  150. $this->assertFalse($utils->checkRequestPath($this->getRequest(), '/foo'));
  151. $this->assertTrue($utils->checkRequestPath($this->getRequest('/foo%20bar'), '/foo bar'));
  152. // Plus must not decoded to space
  153. $this->assertTrue($utils->checkRequestPath($this->getRequest('/foo+bar'), '/foo+bar'));
  154. // Checking unicode
  155. $this->assertTrue($utils->checkRequestPath($this->getRequest('/'.urlencode('вход')), '/вход'));
  156. }
  157. public function testCheckRequestPathWithUrlMatcherAndResourceNotFound()
  158. {
  159. $urlMatcher = $this->getMockBuilder('Symfony\Component\Routing\Matcher\UrlMatcherInterface')->getMock();
  160. $urlMatcher
  161. ->expects($this->any())
  162. ->method('match')
  163. ->with('/')
  164. ->will($this->throwException(new ResourceNotFoundException()))
  165. ;
  166. $utils = new HttpUtils(null, $urlMatcher);
  167. $this->assertFalse($utils->checkRequestPath($this->getRequest(), 'foobar'));
  168. }
  169. public function testCheckRequestPathWithUrlMatcherAndMethodNotAllowed()
  170. {
  171. $request = $this->getRequest();
  172. $urlMatcher = $this->getMockBuilder('Symfony\Component\Routing\Matcher\RequestMatcherInterface')->getMock();
  173. $urlMatcher
  174. ->expects($this->any())
  175. ->method('matchRequest')
  176. ->with($request)
  177. ->will($this->throwException(new MethodNotAllowedException(array())))
  178. ;
  179. $utils = new HttpUtils(null, $urlMatcher);
  180. $this->assertFalse($utils->checkRequestPath($request, 'foobar'));
  181. }
  182. public function testCheckRequestPathWithUrlMatcherAndResourceFoundByUrl()
  183. {
  184. $urlMatcher = $this->getMockBuilder('Symfony\Component\Routing\Matcher\UrlMatcherInterface')->getMock();
  185. $urlMatcher
  186. ->expects($this->any())
  187. ->method('match')
  188. ->with('/foo/bar')
  189. ->will($this->returnValue(array('_route' => 'foobar')))
  190. ;
  191. $utils = new HttpUtils(null, $urlMatcher);
  192. $this->assertTrue($utils->checkRequestPath($this->getRequest('/foo/bar'), 'foobar'));
  193. }
  194. public function testCheckRequestPathWithUrlMatcherAndResourceFoundByRequest()
  195. {
  196. $request = $this->getRequest();
  197. $urlMatcher = $this->getMockBuilder('Symfony\Component\Routing\Matcher\RequestMatcherInterface')->getMock();
  198. $urlMatcher
  199. ->expects($this->any())
  200. ->method('matchRequest')
  201. ->with($request)
  202. ->will($this->returnValue(array('_route' => 'foobar')))
  203. ;
  204. $utils = new HttpUtils(null, $urlMatcher);
  205. $this->assertTrue($utils->checkRequestPath($request, 'foobar'));
  206. }
  207. /**
  208. * @expectedException \RuntimeException
  209. */
  210. public function testCheckRequestPathWithUrlMatcherLoadingException()
  211. {
  212. $urlMatcher = $this->getMockBuilder('Symfony\Component\Routing\Matcher\UrlMatcherInterface')->getMock();
  213. $urlMatcher
  214. ->expects($this->any())
  215. ->method('match')
  216. ->will($this->throwException(new \RuntimeException()))
  217. ;
  218. $utils = new HttpUtils(null, $urlMatcher);
  219. $utils->checkRequestPath($this->getRequest(), 'foobar');
  220. }
  221. public function testCheckPathWithoutRouteParam()
  222. {
  223. $urlMatcher = $this->getMockBuilder('Symfony\Component\Routing\Matcher\UrlMatcherInterface')->getMock();
  224. $urlMatcher
  225. ->expects($this->any())
  226. ->method('match')
  227. ->willReturn(array('_controller' => 'PathController'))
  228. ;
  229. $utils = new HttpUtils(null, $urlMatcher);
  230. $this->assertFalse($utils->checkRequestPath($this->getRequest(), 'path/index.html'));
  231. }
  232. /**
  233. * @expectedException \InvalidArgumentException
  234. * @expectedExceptionMessage Matcher must either implement UrlMatcherInterface or RequestMatcherInterface
  235. */
  236. public function testUrlMatcher()
  237. {
  238. new HttpUtils($this->getUrlGenerator(), new \stdClass());
  239. }
  240. public function testGenerateUriRemovesQueryString()
  241. {
  242. $utils = new HttpUtils($this->getUrlGenerator('/foo/bar'));
  243. $this->assertEquals('/foo/bar', $utils->generateUri(new Request(), 'route_name'));
  244. $utils = new HttpUtils($this->getUrlGenerator('/foo/bar?param=value'));
  245. $this->assertEquals('/foo/bar', $utils->generateUri(new Request(), 'route_name'));
  246. }
  247. /**
  248. * @expectedException \LogicException
  249. * @expectedExceptionMessage You must provide a UrlGeneratorInterface instance to be able to use routes.
  250. */
  251. public function testUrlGeneratorIsRequiredToGenerateUrl()
  252. {
  253. $utils = new HttpUtils();
  254. $utils->generateUri(new Request(), 'route_name');
  255. }
  256. private function getUrlGenerator($generatedUrl = '/foo/bar')
  257. {
  258. $urlGenerator = $this->getMockBuilder('Symfony\Component\Routing\Generator\UrlGeneratorInterface')->getMock();
  259. $urlGenerator
  260. ->expects($this->any())
  261. ->method('generate')
  262. ->will($this->returnValue($generatedUrl))
  263. ;
  264. return $urlGenerator;
  265. }
  266. private function getRequest($path = '/')
  267. {
  268. return Request::create($path, 'get');
  269. }
  270. }