|
1
|
|
|
<?php |
|
2
|
|
|
|
|
3
|
|
|
namespace LaravelAt\ImageSanitize\Tests; |
|
4
|
|
|
|
|
5
|
|
|
use Illuminate\Http\Request; |
|
6
|
|
|
use Illuminate\Http\UploadedFile; |
|
7
|
|
|
use LaravelAt\ImageSanitize\ImageSanitize; |
|
8
|
|
|
use LaravelAt\ImageSanitize\RequestHandler; |
|
9
|
|
|
|
|
10
|
|
|
class RequestHandlerTest extends TestCase |
|
11
|
|
|
{ |
|
12
|
|
|
/** |
|
13
|
|
|
* @var RequestHandler |
|
14
|
|
|
*/ |
|
15
|
|
|
protected $handler; |
|
16
|
|
|
/** |
|
17
|
|
|
* @var ImageSanitize |
|
18
|
|
|
*/ |
|
19
|
|
|
protected $sanitizer; |
|
20
|
|
|
|
|
21
|
|
|
/** @test */ |
|
22
|
|
|
public function it_detects_images_in_the_request(): void |
|
23
|
|
|
{ |
|
24
|
|
|
$request = new Request; |
|
25
|
|
|
|
|
26
|
|
|
$request->files->set('image', UploadedFile::fake()->image('image.jpeg')); |
|
27
|
|
|
$request->files->set('pdf', UploadedFile::fake()->create('document.pdf')); |
|
28
|
|
|
|
|
29
|
|
|
$this->assertArrayHasKey( |
|
30
|
|
|
'image', |
|
31
|
|
|
$this->handler->getImages($request->allFiles()) |
|
32
|
|
|
); |
|
33
|
|
|
$this->assertArrayNotHasKey( |
|
34
|
|
|
'pdf', |
|
35
|
|
|
$this->handler->getImages($request->allFiles()) |
|
36
|
|
|
); |
|
37
|
|
|
} |
|
38
|
|
|
|
|
39
|
|
|
/** @test */ |
|
40
|
|
|
public function it_swaps_the_file_content_with_the_sanitized_string(): void |
|
41
|
|
|
{ |
|
42
|
|
|
$uploadedFile = UploadedFile::fake()->image('malicious.jpeg', '100', '100'); |
|
43
|
|
|
file_put_contents($uploadedFile->getPathname(), file_get_contents(__DIR__.'/stubs/exploit.jpeg')); |
|
44
|
|
|
|
|
45
|
|
|
$request = new Request; |
|
46
|
|
|
$request->files->set('image', $uploadedFile); |
|
47
|
|
|
|
|
48
|
|
|
$maliciousImageContent = $request->file('image')->get(); |
|
49
|
|
|
$this->handler->handle($request); |
|
50
|
|
|
|
|
51
|
|
|
$sanitizedImageContent = $request->file('image')->get(); |
|
52
|
|
|
$this->assertNotEquals( |
|
53
|
|
|
$maliciousImageContent, |
|
54
|
|
|
$sanitizedImageContent |
|
55
|
|
|
); |
|
56
|
|
|
$this->assertFalse($this->sanitizer->detect($sanitizedImageContent)); |
|
57
|
|
|
} |
|
58
|
|
|
|
|
59
|
|
|
protected function setUp(): void |
|
60
|
|
|
{ |
|
61
|
|
|
parent::setUp(); |
|
62
|
|
|
|
|
63
|
|
|
$this->handler = $this->app->make(RequestHandler::class); |
|
64
|
|
|
|
|
65
|
|
|
$this->sanitizer = $this->app->make(ImageSanitize::class); |
|
66
|
|
|
} |
|
67
|
|
|
} |
|
68
|
|
|
|
laravel-at /
laravel-image-sanitize
