1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
namespace spec\Knp\RadBundle\EventListener; |
4
|
|
|
|
5
|
|
|
use PhpSpec\ObjectBehavior; |
6
|
|
|
use Prophecy\Argument as Arg; |
7
|
|
|
|
8
|
|
|
class CsrfListenerSpec extends ObjectBehavior |
9
|
|
|
{ |
10
|
|
|
/** |
11
|
|
|
* @param Symfony\Component\Form\Extension\Csrf\CsrfProvider\CsrfProviderInterface $csrfProvider |
12
|
|
|
* @param Symfony\Component\HttpKernel\Event\GetResponseEvent $event |
13
|
|
|
* @param Symfony\Component\HttpFoundation\Request $request |
14
|
|
|
* @param Symfony\Component\HttpFoundation\ParameterBag $requestBag |
15
|
|
|
* @param Symfony\Component\HttpFoundation\ParameterBag $attributeBag |
16
|
|
|
*/ |
17
|
|
|
function let($csrfProvider, $event, $request, $requestBag, $attributeBag) |
18
|
|
|
{ |
19
|
|
|
$event->getRequest()->willReturn($request); |
20
|
|
|
$request->request = $requestBag; |
21
|
|
|
$request->attributes = $attributeBag; |
22
|
|
|
|
23
|
|
|
$this->beConstructedWith($csrfProvider); |
24
|
|
|
} |
25
|
|
|
|
26
|
|
|
function its_onKernelRequest_should_continue_if_csrf_valid($event, $request, $requestBag, $attributeBag, $csrfProvider) |
|
|
|
|
27
|
|
|
{ |
28
|
|
|
$attributeBag->get('_check_csrf', false)->shouldBeCalled()->willReturn(true); |
29
|
|
|
$requestBag->has('_link_token')->shouldBeCalled()->willReturn(true); |
30
|
|
|
$requestBag->get('_link_token')->shouldBeCalled()->willReturn('some token'); |
31
|
|
|
$csrfProvider->isCsrfTokenValid('link', 'some token')->shouldBeCalled()->willReturn(true); |
32
|
|
|
|
33
|
|
|
$this->onKernelRequest($event); |
34
|
|
|
} |
35
|
|
|
|
36
|
|
|
function its_onKernelRequest_should_continue_if_no_csrf_provided_and_check_csrf_disabled($event, $request, $requestBag, $attributeBag, $csrfProvider) |
|
|
|
|
37
|
|
|
{ |
38
|
|
|
$attributeBag->get('_check_csrf', false)->shouldBeCalled()->willReturn(false); |
39
|
|
|
$requestBag->get('_link_token')->shouldNotBeCalled(); |
40
|
|
|
$csrfProvider->isCsrfTokenValid('link', Arg::type('string'))->shouldNotBeCalled(); |
41
|
|
|
|
42
|
|
|
$this->onKernelRequest($event); |
43
|
|
|
} |
44
|
|
|
|
45
|
|
|
function its_onKernelRequest_should_throw_exception_if_no_csrf_provided_and_check_csrf_enabled($event, $request, $requestBag, $attributeBag, $csrfProvider) |
|
|
|
|
46
|
|
|
{ |
47
|
|
|
$attributeBag->get('_check_csrf', false)->shouldBeCalled()->willReturn(true); |
48
|
|
|
$requestBag->has('_link_token')->shouldBeCalled()->willReturn(false); |
49
|
|
|
$requestBag->get('_link_token')->shouldNotBeCalled(); |
50
|
|
|
$csrfProvider->isCsrfTokenValid('link', Arg::type('string'))->shouldNotBeCalled(); |
51
|
|
|
|
52
|
|
|
$this->shouldThrow(new \InvalidArgumentException( |
53
|
|
|
'The CSRF token verification is activated but you did not send a token. Please submit a request with a valid csrf token.' |
54
|
|
|
))->duringOnKernelRequest($event); |
55
|
|
|
} |
56
|
|
|
|
57
|
|
|
function its_onKernelRequest_should_throw_exception_if_csrf_invalid($event, $request, $requestBag, $attributeBag, $csrfProvider) |
|
|
|
|
58
|
|
|
{ |
59
|
|
|
$attributeBag->get('_check_csrf', false)->shouldBeCalled()->willReturn(true); |
60
|
|
|
$requestBag->has('_link_token')->shouldBeCalled()->willReturn(true); |
61
|
|
|
$requestBag->get('_link_token')->shouldBeCalled()->willReturn('some token'); |
62
|
|
|
$csrfProvider->isCsrfTokenValid('link', 'some token')->shouldBeCalled()->willReturn(false); |
63
|
|
|
|
64
|
|
|
$this->shouldThrow(new \InvalidArgumentException( |
65
|
|
|
'The CSRF token is invalid. Please submit a request with a valid csrf token.' |
66
|
|
|
))->duringOnKernelRequest($event); |
67
|
|
|
} |
68
|
|
|
|
69
|
|
|
function its_onKernelRequest_should_use_the_link_string_as_csrf_intention($event, $request, $requestBag, $attributeBag, $csrfProvider) |
|
|
|
|
70
|
|
|
{ |
71
|
|
|
$attributeBag->get('_check_csrf', false)->shouldBeCalled()->willReturn(true); |
72
|
|
|
$requestBag->has('_link_token')->shouldBeCalled()->willReturn(true); |
73
|
|
|
$requestBag->get('_link_token')->shouldBeCalled()->willReturn('some token'); |
74
|
|
|
$csrfProvider->isCsrfTokenValid('link', 'some token')->shouldBeCalled()->willReturn(true); |
75
|
|
|
|
76
|
|
|
$this->onKernelRequest($event); |
77
|
|
|
} |
78
|
|
|
} |
79
|
|
|
|
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.