facebook /
facebook-php-sdk-v4
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * Copyright 2016 Facebook, Inc. |
||
| 4 | * |
||
| 5 | * You are hereby granted a non-exclusive, worldwide, royalty-free license to |
||
| 6 | * use, copy, modify, and distribute this software in source code or binary |
||
| 7 | * form for use in connection with the web services and APIs provided by |
||
| 8 | * Facebook. |
||
| 9 | * |
||
| 10 | * As with any software that integrates with the Facebook platform, your use |
||
| 11 | * of this software is subject to the Facebook Developer Principles and |
||
| 12 | * Policies [http://developers.facebook.com/policy/]. This copyright notice |
||
| 13 | * shall be included in all copies or substantial portions of the software. |
||
| 14 | * |
||
| 15 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
||
| 16 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
||
| 17 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL |
||
| 18 | * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
||
| 19 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING |
||
| 20 | * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER |
||
| 21 | * DEALINGS IN THE SOFTWARE. |
||
| 22 | * |
||
| 23 | */ |
||
| 24 | namespace Facebook\Tests; |
||
| 25 | |||
| 26 | use Facebook\Facebook; |
||
| 27 | use Facebook\FacebookApp; |
||
| 28 | use Facebook\FacebookRequest; |
||
| 29 | use Facebook\FacebookBatchRequest; |
||
| 30 | use Facebook\FileUpload\FacebookFile; |
||
| 31 | |||
| 32 | class FacebookBatchRequestTest extends \PHPUnit_Framework_TestCase |
||
| 33 | { |
||
| 34 | /** |
||
| 35 | * @var FacebookApp |
||
| 36 | */ |
||
| 37 | private $app; |
||
| 38 | |||
| 39 | protected function setUp() |
||
| 40 | { |
||
| 41 | $this->app = new FacebookApp('123', 'foo_secret'); |
||
| 42 | } |
||
| 43 | |||
| 44 | public function testABatchRequestWillInstantiateWithTheProperProperties() |
||
| 45 | { |
||
| 46 | $batchRequest = new FacebookBatchRequest($this->app, [], 'foo_token', 'v0.1337'); |
||
| 47 | |||
| 48 | $this->assertSame($this->app, $batchRequest->getApp()); |
||
| 49 | $this->assertEquals('foo_token', $batchRequest->getAccessToken()); |
||
| 50 | $this->assertEquals('POST', $batchRequest->getMethod()); |
||
| 51 | $this->assertEquals('', $batchRequest->getEndpoint()); |
||
| 52 | $this->assertEquals('v0.1337', $batchRequest->getGraphVersion()); |
||
| 53 | } |
||
| 54 | |||
| 55 | public function testEmptyRequestWillFallbackToBatchDefaults() |
||
| 56 | { |
||
| 57 | $request = new FacebookRequest(); |
||
| 58 | |||
| 59 | $this->createBatchRequest()->addFallbackDefaults($request); |
||
| 60 | |||
| 61 | $this->assertRequestContainsAppAndToken($request, $this->app, 'foo_token'); |
||
| 62 | } |
||
| 63 | |||
| 64 | public function testRequestWithTokenOnlyWillFallbackToBatchDefaults() |
||
| 65 | { |
||
| 66 | $request = new FacebookRequest(null, 'bar_token'); |
||
| 67 | |||
| 68 | $this->createBatchRequest()->addFallbackDefaults($request); |
||
| 69 | |||
| 70 | $this->assertRequestContainsAppAndToken($request, $this->app, 'bar_token'); |
||
| 71 | } |
||
| 72 | |||
| 73 | public function testRequestWithAppOnlyWillFallbackToBatchDefaults() |
||
| 74 | { |
||
| 75 | $customApp = new FacebookApp('1337', 'bar_secret'); |
||
| 76 | $request = new FacebookRequest($customApp); |
||
| 77 | |||
| 78 | $this->createBatchRequest()->addFallbackDefaults($request); |
||
| 79 | |||
| 80 | $this->assertRequestContainsAppAndToken($request, $customApp, 'foo_token'); |
||
| 81 | } |
||
| 82 | |||
| 83 | /** |
||
| 84 | * @expectedException \Facebook\Exceptions\FacebookSDKException |
||
| 85 | */ |
||
| 86 | public function testWillThrowWhenNoThereIsNoAppFallback() |
||
| 87 | { |
||
| 88 | $batchRequest = new FacebookBatchRequest(); |
||
| 89 | |||
| 90 | $batchRequest->addFallbackDefaults(new FacebookRequest(null, 'foo_token')); |
||
| 91 | } |
||
| 92 | |||
| 93 | /** |
||
| 94 | * @expectedException \Facebook\Exceptions\FacebookSDKException |
||
| 95 | */ |
||
| 96 | public function testWillThrowWhenNoThereIsNoAccessTokenFallback() |
||
| 97 | { |
||
| 98 | $request = new FacebookBatchRequest(); |
||
| 99 | |||
| 100 | $request->addFallbackDefaults(new FacebookRequest($this->app)); |
||
| 101 | } |
||
| 102 | |||
| 103 | /** |
||
| 104 | * @expectedException \InvalidArgumentException |
||
| 105 | */ |
||
| 106 | public function testAnInvalidTypeGivenToAddWillThrow() |
||
| 107 | { |
||
| 108 | $request = new FacebookBatchRequest(); |
||
| 109 | |||
| 110 | $request->add('foo'); |
||
|
0 ignored issues
–
show
|
|||
| 111 | } |
||
| 112 | |||
| 113 | public function testAddingRequestsWillBeFormattedInAnArrayProperly() |
||
| 114 | { |
||
| 115 | $requests = [ |
||
| 116 | null => new FacebookRequest(null, null, 'GET', '/foo'), |
||
| 117 | 'my-second-request' => new FacebookRequest(null, null, 'POST', '/bar', ['foo' => 'bar']), |
||
| 118 | 'my-third-request' => new FacebookRequest(null, null, 'DELETE', '/baz') |
||
| 119 | ]; |
||
| 120 | |||
| 121 | $batchRequest = $this->createBatchRequest(); |
||
| 122 | $batchRequest->add($requests[null]); |
||
| 123 | $batchRequest->add($requests['my-second-request'], 'my-second-request'); |
||
| 124 | $batchRequest->add($requests['my-third-request'], 'my-third-request'); |
||
| 125 | |||
| 126 | $formattedRequests = $batchRequest->getRequests(); |
||
| 127 | |||
| 128 | $this->assertRequestsMatch($requests, $formattedRequests); |
||
| 129 | } |
||
| 130 | |||
| 131 | View Code Duplication | public function testANumericArrayOfRequestsCanBeAdded() |
|
| 132 | { |
||
| 133 | $requests = [ |
||
| 134 | new FacebookRequest(null, null, 'GET', '/foo'), |
||
| 135 | new FacebookRequest(null, null, 'POST', '/bar', ['foo' => 'bar']), |
||
| 136 | new FacebookRequest(null, null, 'DELETE', '/baz'), |
||
| 137 | ]; |
||
| 138 | |||
| 139 | $formattedRequests = $this->createBatchRequestWithRequests($requests)->getRequests(); |
||
| 140 | |||
| 141 | $this->assertRequestsMatch($requests, $formattedRequests); |
||
| 142 | } |
||
| 143 | |||
| 144 | View Code Duplication | public function testAnAssociativeArrayOfRequestsCanBeAdded() |
|
| 145 | { |
||
| 146 | $requests = [ |
||
| 147 | 'req-one' => new FacebookRequest(null, null, 'GET', '/foo'), |
||
| 148 | 'req-two' => new FacebookRequest(null, null, 'POST', '/bar', ['foo' => 'bar']), |
||
| 149 | 'req-three' => new FacebookRequest(null, null, 'DELETE', '/baz'), |
||
| 150 | ]; |
||
| 151 | |||
| 152 | $formattedRequests = $this->createBatchRequestWithRequests($requests)->getRequests(); |
||
| 153 | |||
| 154 | $this->assertRequestsMatch($requests, $formattedRequests); |
||
| 155 | } |
||
| 156 | |||
| 157 | public function testRequestsCanBeInjectedIntoConstructor() |
||
| 158 | { |
||
| 159 | $requests = [ |
||
| 160 | new FacebookRequest(null, null, 'GET', '/foo'), |
||
| 161 | new FacebookRequest(null, null, 'POST', '/bar', ['foo' => 'bar']), |
||
| 162 | new FacebookRequest(null, null, 'DELETE', '/baz'), |
||
| 163 | ]; |
||
| 164 | |||
| 165 | $batchRequest = new FacebookBatchRequest($this->app, $requests, 'foo_token'); |
||
| 166 | $formattedRequests = $batchRequest->getRequests(); |
||
| 167 | |||
| 168 | $this->assertRequestsMatch($requests, $formattedRequests); |
||
| 169 | } |
||
| 170 | |||
| 171 | /** |
||
| 172 | * @expectedException \Facebook\Exceptions\FacebookSDKException |
||
| 173 | */ |
||
| 174 | public function testAZeroRequestCountWithThrow() |
||
| 175 | { |
||
| 176 | $batchRequest = new FacebookBatchRequest($this->app, [], 'foo_token'); |
||
| 177 | |||
| 178 | $batchRequest->validateBatchRequestCount(); |
||
| 179 | } |
||
| 180 | |||
| 181 | /** |
||
| 182 | * @expectedException \Facebook\Exceptions\FacebookSDKException |
||
| 183 | */ |
||
| 184 | public function testMoreThanFiftyRequestsWillThrow() |
||
| 185 | { |
||
| 186 | $batchRequest = $this->createBatchRequest(); |
||
| 187 | |||
| 188 | $this->createAndAppendRequestsTo($batchRequest, 51); |
||
| 189 | |||
| 190 | $batchRequest->validateBatchRequestCount(); |
||
| 191 | } |
||
| 192 | |||
| 193 | public function testLessOrEqualThanFiftyRequestsWillNotThrow() |
||
| 194 | { |
||
| 195 | $batchRequest = $this->createBatchRequest(); |
||
| 196 | |||
| 197 | $this->createAndAppendRequestsTo($batchRequest, 50); |
||
| 198 | |||
| 199 | $batchRequest->validateBatchRequestCount(); |
||
| 200 | } |
||
| 201 | |||
| 202 | /** |
||
| 203 | * @dataProvider requestsAndExpectedResponsesProvider |
||
| 204 | */ |
||
| 205 | public function testBatchRequestEntitiesProperlyGetConvertedToAnArray($request, $expectedArray) |
||
| 206 | { |
||
| 207 | $batchRequest = $this->createBatchRequest(); |
||
| 208 | $batchRequest->add($request, 'foo_name'); |
||
| 209 | |||
| 210 | $requests = $batchRequest->getRequests(); |
||
| 211 | $batchRequestArray = $batchRequest->requestEntityToBatchArray($requests[0]['request'], $requests[0]['name']); |
||
| 212 | |||
| 213 | $this->assertEquals($expectedArray, $batchRequestArray); |
||
| 214 | } |
||
| 215 | |||
| 216 | public function requestsAndExpectedResponsesProvider() |
||
| 217 | { |
||
| 218 | $headers = $this->defaultHeaders(); |
||
| 219 | $apiVersion = Facebook::DEFAULT_GRAPH_VERSION; |
||
| 220 | |||
| 221 | return [ |
||
| 222 | [ |
||
| 223 | new FacebookRequest(null, null, 'GET', '/foo', ['foo' => 'bar']), |
||
| 224 | [ |
||
| 225 | 'headers' => $headers, |
||
| 226 | 'method' => 'GET', |
||
| 227 | 'relative_url' => '/' . $apiVersion . '/foo?foo=bar&access_token=foo_token&appsecret_proof=df4256903ba4e23636cc142117aa632133d75c642bd2a68955be1443bd14deb9', |
||
| 228 | 'name' => 'foo_name', |
||
| 229 | ], |
||
| 230 | ], |
||
| 231 | [ |
||
| 232 | new FacebookRequest(null, null, 'POST', '/bar', ['bar' => 'baz']), |
||
| 233 | [ |
||
| 234 | 'headers' => $headers, |
||
| 235 | 'method' => 'POST', |
||
| 236 | 'relative_url' => '/' . $apiVersion . '/bar', |
||
| 237 | 'body' => 'bar=baz&access_token=foo_token&appsecret_proof=df4256903ba4e23636cc142117aa632133d75c642bd2a68955be1443bd14deb9', |
||
| 238 | 'name' => 'foo_name', |
||
| 239 | ], |
||
| 240 | ], |
||
| 241 | [ |
||
| 242 | new FacebookRequest(null, null, 'DELETE', '/bar'), |
||
| 243 | [ |
||
| 244 | 'headers' => $headers, |
||
| 245 | 'method' => 'DELETE', |
||
| 246 | 'relative_url' => '/' . $apiVersion . '/bar?access_token=foo_token&appsecret_proof=df4256903ba4e23636cc142117aa632133d75c642bd2a68955be1443bd14deb9', |
||
| 247 | 'name' => 'foo_name', |
||
| 248 | ], |
||
| 249 | ], |
||
| 250 | ]; |
||
| 251 | } |
||
| 252 | |||
| 253 | public function testBatchRequestsWithFilesGetConvertedToAnArray() |
||
| 254 | { |
||
| 255 | $request = new FacebookRequest(null, null, 'POST', '/bar', [ |
||
| 256 | 'message' => 'foobar', |
||
| 257 | 'source' => new FacebookFile(__DIR__ . '/foo.txt'), |
||
| 258 | ]); |
||
| 259 | |||
| 260 | $batchRequest = $this->createBatchRequest(); |
||
| 261 | $batchRequest->add($request, 'foo_name'); |
||
| 262 | |||
| 263 | $requests = $batchRequest->getRequests(); |
||
| 264 | |||
| 265 | $attachedFiles = $requests[0]['attached_files']; |
||
| 266 | |||
| 267 | $batchRequestArray = $batchRequest->requestEntityToBatchArray( |
||
| 268 | $requests[0]['request'], |
||
| 269 | $requests[0]['name'], |
||
| 270 | $attachedFiles |
||
| 271 | ); |
||
| 272 | |||
| 273 | $this->assertEquals([ |
||
| 274 | 'headers' => $this->defaultHeaders(), |
||
| 275 | 'method' => 'POST', |
||
| 276 | 'relative_url' => '/' . Facebook::DEFAULT_GRAPH_VERSION . '/bar', |
||
| 277 | 'body' => 'message=foobar&access_token=foo_token&appsecret_proof=df4256903ba4e23636cc142117aa632133d75c642bd2a68955be1443bd14deb9', |
||
| 278 | 'name' => 'foo_name', |
||
| 279 | 'attached_files' => $attachedFiles, |
||
| 280 | ], $batchRequestArray); |
||
| 281 | } |
||
| 282 | |||
| 283 | public function testPreppingABatchRequestProperlySetsThePostParams() |
||
| 284 | { |
||
| 285 | $batchRequest = $this->createBatchRequest(); |
||
| 286 | $batchRequest->add(new FacebookRequest(null, 'bar_token', 'GET', '/foo'), 'foo_name'); |
||
| 287 | $batchRequest->add(new FacebookRequest(null, null, 'POST', '/bar', ['foo' => 'bar'])); |
||
| 288 | $batchRequest->prepareRequestsForBatch(); |
||
| 289 | |||
| 290 | $params = $batchRequest->getParams(); |
||
| 291 | |||
| 292 | $expectedHeaders = json_encode($this->defaultHeaders()); |
||
| 293 | $version = Facebook::DEFAULT_GRAPH_VERSION; |
||
| 294 | $expectedBatchParams = [ |
||
| 295 | 'batch' => '[{"headers":' . $expectedHeaders . ',"method":"GET","relative_url":"\\/' . $version . '\\/foo?access_token=bar_token&appsecret_proof=2ceec40b7b9fd7d38fff1767b766bcc6b1f9feb378febac4612c156e6a8354bd","name":"foo_name"},' |
||
| 296 | . '{"headers":' . $expectedHeaders . ',"method":"POST","relative_url":"\\/' . $version . '\\/bar","body":"foo=bar&access_token=foo_token&appsecret_proof=df4256903ba4e23636cc142117aa632133d75c642bd2a68955be1443bd14deb9"}]', |
||
| 297 | 'include_headers' => true, |
||
| 298 | 'access_token' => 'foo_token', |
||
| 299 | 'appsecret_proof' => 'df4256903ba4e23636cc142117aa632133d75c642bd2a68955be1443bd14deb9', |
||
| 300 | ]; |
||
| 301 | $this->assertEquals($expectedBatchParams, $params); |
||
| 302 | } |
||
| 303 | |||
| 304 | public function testPreppingABatchRequestProperlyMovesTheFiles() |
||
| 305 | { |
||
| 306 | $batchRequest = $this->createBatchRequest(); |
||
| 307 | $batchRequest->add(new FacebookRequest(null, 'bar_token', 'GET', '/foo'), 'foo_name'); |
||
| 308 | $batchRequest->add(new FacebookRequest(null, null, 'POST', '/me/photos', [ |
||
| 309 | 'message' => 'foobar', |
||
| 310 | 'source' => new FacebookFile(__DIR__ . '/foo.txt'), |
||
| 311 | ])); |
||
| 312 | $batchRequest->prepareRequestsForBatch(); |
||
| 313 | |||
| 314 | $params = $batchRequest->getParams(); |
||
| 315 | $files = $batchRequest->getFiles(); |
||
| 316 | |||
| 317 | $attachedFiles = implode(',', array_keys($files)); |
||
| 318 | |||
| 319 | $expectedHeaders = json_encode($this->defaultHeaders()); |
||
| 320 | $version = Facebook::DEFAULT_GRAPH_VERSION; |
||
| 321 | $expectedBatchParams = [ |
||
| 322 | 'batch' => '[{"headers":' . $expectedHeaders . ',"method":"GET","relative_url":"\\/' . $version . '\\/foo?access_token=bar_token&appsecret_proof=2ceec40b7b9fd7d38fff1767b766bcc6b1f9feb378febac4612c156e6a8354bd","name":"foo_name"},' |
||
| 323 | . '{"headers":' . $expectedHeaders . ',"method":"POST","relative_url":"\\/' . $version . '\\/me\\/photos","body":"message=foobar&access_token=foo_token&appsecret_proof=df4256903ba4e23636cc142117aa632133d75c642bd2a68955be1443bd14deb9","attached_files":"' . $attachedFiles . '"}]', |
||
| 324 | 'include_headers' => true, |
||
| 325 | 'access_token' => 'foo_token', |
||
| 326 | 'appsecret_proof' => 'df4256903ba4e23636cc142117aa632133d75c642bd2a68955be1443bd14deb9', |
||
| 327 | ]; |
||
| 328 | $this->assertEquals($expectedBatchParams, $params); |
||
| 329 | } |
||
| 330 | |||
| 331 | private function assertRequestContainsAppAndToken(FacebookRequest $request, FacebookApp $expectedApp, $expectedToken) |
||
| 332 | { |
||
| 333 | $app = $request->getApp(); |
||
| 334 | $token = $request->getAccessToken(); |
||
| 335 | |||
| 336 | $this->assertSame($expectedApp, $app); |
||
| 337 | $this->assertEquals($expectedToken, $token); |
||
| 338 | } |
||
| 339 | |||
| 340 | private function defaultHeaders() |
||
| 341 | { |
||
| 342 | $headers = []; |
||
| 343 | foreach (FacebookRequest::getDefaultHeaders() as $name => $value) { |
||
| 344 | $headers[] = $name . ': ' . $value; |
||
| 345 | } |
||
| 346 | |||
| 347 | return $headers; |
||
| 348 | } |
||
| 349 | |||
| 350 | private function createAndAppendRequestsTo(FacebookBatchRequest $batchRequest, $number) |
||
| 351 | { |
||
| 352 | for ($i = 0; $i < $number; $i++) { |
||
| 353 | $batchRequest->add(new FacebookRequest()); |
||
| 354 | } |
||
| 355 | } |
||
| 356 | |||
| 357 | private function createBatchRequest() |
||
| 358 | { |
||
| 359 | return new FacebookBatchRequest($this->app, [], 'foo_token'); |
||
| 360 | } |
||
| 361 | |||
| 362 | private function createBatchRequestWithRequests(array $requests) |
||
| 363 | { |
||
| 364 | $batchRequest = $this->createBatchRequest(); |
||
| 365 | $batchRequest->add($requests); |
||
| 366 | |||
| 367 | return $batchRequest; |
||
| 368 | } |
||
| 369 | |||
| 370 | private function assertRequestsMatch($requests, $formattedRequests) |
||
| 371 | { |
||
| 372 | $expectedRequests = []; |
||
| 373 | foreach ($requests as $name => $request) { |
||
| 374 | $expectedRequests[] = [ |
||
| 375 | 'name' => $name, |
||
| 376 | 'request' => $request |
||
| 377 | ]; |
||
| 378 | } |
||
| 379 | $this->assertEquals($expectedRequests, $formattedRequests); |
||
| 380 | } |
||
| 381 | } |
||
| 382 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: