Issues in WhitelistSecurityPolicyTest.php (v5) - Issues in v5 - nystudio107/craft-twig-sandbox - Measure and Improve Code Quality continuously with Scrutinizer

Issues (4)

tests/Feature/WhitelistSecurityPolicyTest.php (1 issue)

Labels

Bug 1

Severity

Major 1

<?php

/**
 * Tests the Whitelist Security Policy.
 */

use craft\config\GeneralConfig;
use craft\services\Config;
.
|-- OtherDir
|   |-- Bar.php
|   `-- Foo.php
`-- SomeDir
    `-- Foo.php
use craft\web\Application;
use craft\web\twig\variables\CraftVariable;
use nystudio107\crafttwigsandbox\twig\WhitelistSecurityPolicy;
use nystudio107\crafttwigsandbox\web\SandboxView;
use Twig\Sandbox\SecurityNotAllowedFilterError;
use Twig\Sandbox\SecurityNotAllowedFunctionError;
use Twig\Sandbox\SecurityNotAllowedMethodError;
use Twig\Sandbox\SecurityNotAllowedPropertyError;
use Twig\Sandbox\SecurityNotAllowedTagError;

test('Whitelisted tag is allowed', function() {
    $sandboxView = new SandboxView([
        'securityPolicy' => new WhitelistSecurityPolicy([
            'twigTags' => ['set'],
        ]),
    ]);
    $sandboxView->renderString('{% set x = 1 %}');
})->throwsNoExceptions();

test('Non whitelisted tag is not allowed', function() {
    $sandboxView = new SandboxView([
        'securityPolicy' => new WhitelistSecurityPolicy([
            'twigTags' => [],
        ]),
    ]);
    $sandboxView->renderString('{% set x = 1 %}');
})->throws(SecurityNotAllowedTagError::class);

test('Whitelisted filter is allowed', function() {
    $sandboxView = new SandboxView([
        'securityPolicy' => new WhitelistSecurityPolicy([
            'twigFilters' => ['abs'],
        ]),
    ]);
    $sandboxView->renderString('{{ 6|abs }}');
})->throwsNoExceptions();

test('Non whitelisted filter is not allowed', function() {
    $sandboxView = new SandboxView([
        'securityPolicy' => new WhitelistSecurityPolicy([
            'twigFilters' => [],
        ]),
    ]);
    $sandboxView->renderString('{{ 6|abs }}');
})->throws(SecurityNotAllowedFilterError::class);

test('Whitelisted function is allowed', function() {
    $sandboxView = new SandboxView([
        'securityPolicy' => new WhitelistSecurityPolicy([
            'twigFunctions' => ['random'],
        ]),
    ]);
    $sandboxView->renderString('{{ random() }}');
})->throwsNoExceptions();

test('Non whitelisted function is not allowed', function() {
    $sandboxView = new SandboxView([
        'securityPolicy' => new WhitelistSecurityPolicy([
            'twigFunctions' => [],
        ]),
    ]);
    $sandboxView->renderString('{{ random() }}');
})->throws(SecurityNotAllowedFunctionError::class);

test('Whitelisted object method is allowed', function() {
    $sandboxView = new SandboxView([
        'securityPolicy' => new WhitelistSecurityPolicy([
            'twigTags' => ['set'],
            'twigMethods' => [
                Application::class => ['getConfig'],
                Config::class => ['getGeneral'],
                GeneralConfig::class => ['devMode'],
            ],
            'twigProperties' => [
                CraftVariable::class => ['app'],
            ]
        ]),
    ]);
    $sandboxView->renderString('{% set dev = craft.app.getConfig().getGeneral().devMode(true) %}');
})->throwsNoExceptions();

test('Whitelisted wildcard object method is allowed', function() {
    $sandboxView = new SandboxView([
        'securityPolicy' => new WhitelistSecurityPolicy([
            'twigTags' => ['set'],
            'twigMethods' => [
                Application::class => '*',
                Config::class => '*',
                GeneralConfig::class => '*',
            ],
            'twigProperties' => [
                CraftVariable::class => ['app'],
            ]
        ]),
    ]);
    $sandboxView->renderString('{% set dev = craft.app.getConfig().getGeneral().devMode(true) %}');
})->throwsNoExceptions();

test('Non whitelisted object method is not allowed', function() {
    $sandboxView = new SandboxView([
        'securityPolicy' => new WhitelistSecurityPolicy([
            'twigMethods' => [],
            'twigProperties' => [
                CraftVariable::class => ['app'],
            ]
        ]),
    ]);
    $sandboxView->renderString('{{ craft.app.getConfig().getGeneral().getDevMode() }}');
})->throws(SecurityNotAllowedMethodError::class);

test('Whitelisted object property is allowed', function() {
    $sandboxView = new SandboxView([
        'securityPolicy' => new WhitelistSecurityPolicy([
            'twigProperties' => [
                Application::class => ['config'],
                Config::class => ['general'],
                GeneralConfig::class => ['devMode'],
                CraftVariable::class => ['app'],
            ]
        ]),
    ]);
    $sandboxView->renderString('{{ craft.app.config.general.devMode }}');
})->throwsNoExceptions();

test('Whitelisted wildcard object property is allowed', function() {
    $sandboxView = new SandboxView([
        'securityPolicy' => new WhitelistSecurityPolicy([
            'twigProperties' => [
                Application::class => '*',
                Config::class => '*',
                GeneralConfig::class => '*',
                CraftVariable::class => ['app'],
            ]
        ]),
    ]);
    $sandboxView->renderString('{{ craft.app.config.general.devMode }}');
})->throwsNoExceptions();

test('Non whitelisted object property is not allowed', function() {
    $sandboxView = new SandboxView([
        'securityPolicy' => new WhitelistSecurityPolicy([
            'twigMethods' => [],
            'twigProperties' => [
                CraftVariable::class => ['app'],
            ]
        ]),
    ]);
    $sandboxView->renderString('{{ craft.app.config.general.devMode }}');
})->throws(SecurityNotAllowedPropertyError::class);


1			<?php
2
3			/**
4			* Tests the Whitelist Security Policy.
5			*/
6
7			use craft\config\GeneralConfig;
8			use craft\services\Config;
			0 ignored issues – show Bug introduced 2024-07-03 22:24 UTC by Report Bug Copy Issue Report Show Similar Issues like this This use statement conflicts with another class in this namespace, `Config`. Consider defining an alias. Let?s assume that you have a directory layout like this: . \|-- OtherDir \| \|-- Bar.php \| `-- Foo.php `-- SomeDir `-- Foo.php and let?s assume the following content of `Bar.php`: // Bar.php namespace OtherDir; use SomeDir\Foo; // This now conflicts the class OtherDir\Foo If both files `OtherDir/Foo.php` and `SomeDir/Foo.php` are loaded in the same runtime, you will see a PHP error such as the following: PHP Fatal error: Cannot use SomeDir\Foo as Foo because the name is already in use in OtherDir/Foo.php However, as `OtherDir/Foo.php` does not necessarily have to be loaded and the error is only triggered if it is loaded before `OtherDir/Bar.php`, this problem might go unnoticed for a while. In order to prevent this error from surfacing, you must import the namespace with a different alias: // Bar.php namespace OtherDir; use SomeDir\Foo as SomeDirFoo; // There is no conflict anymore. Loading history...
9			use craft\web\Application;
10			use craft\web\twig\variables\CraftVariable;
11			use nystudio107\crafttwigsandbox\twig\WhitelistSecurityPolicy;
12			use nystudio107\crafttwigsandbox\web\SandboxView;
13			use Twig\Sandbox\SecurityNotAllowedFilterError;
14			use Twig\Sandbox\SecurityNotAllowedFunctionError;
15			use Twig\Sandbox\SecurityNotAllowedMethodError;
16			use Twig\Sandbox\SecurityNotAllowedPropertyError;
17			use Twig\Sandbox\SecurityNotAllowedTagError;
18
19			test('Whitelisted tag is allowed', function() {
20			$sandboxView = new SandboxView([
21			'securityPolicy' => new WhitelistSecurityPolicy([
22			'twigTags' => ['set'],
23			]),
24			]);
25			$sandboxView->renderString('{% set x = 1 %}');
26			})->throwsNoExceptions();
27
28			test('Non whitelisted tag is not allowed', function() {
29			$sandboxView = new SandboxView([
30			'securityPolicy' => new WhitelistSecurityPolicy([
31			'twigTags' => [],
32			]),
33			]);
34			$sandboxView->renderString('{% set x = 1 %}');
35			})->throws(SecurityNotAllowedTagError::class);
36
37			test('Whitelisted filter is allowed', function() {
38			$sandboxView = new SandboxView([
39			'securityPolicy' => new WhitelistSecurityPolicy([
40			'twigFilters' => ['abs'],
41			]),
42			]);
43			$sandboxView->renderString('{{ 6\|abs }}');
44			})->throwsNoExceptions();
45
46			test('Non whitelisted filter is not allowed', function() {
47			$sandboxView = new SandboxView([
48			'securityPolicy' => new WhitelistSecurityPolicy([
49			'twigFilters' => [],
50			]),
51			]);
52			$sandboxView->renderString('{{ 6\|abs }}');
53			})->throws(SecurityNotAllowedFilterError::class);
54
55			test('Whitelisted function is allowed', function() {
56			$sandboxView = new SandboxView([
57			'securityPolicy' => new WhitelistSecurityPolicy([
58			'twigFunctions' => ['random'],
59			]),
60			]);
61			$sandboxView->renderString('{{ random() }}');
62			})->throwsNoExceptions();
63
64			test('Non whitelisted function is not allowed', function() {
65			$sandboxView = new SandboxView([
66			'securityPolicy' => new WhitelistSecurityPolicy([
67			'twigFunctions' => [],
68			]),
69			]);
70			$sandboxView->renderString('{{ random() }}');
71			})->throws(SecurityNotAllowedFunctionError::class);
72
73			test('Whitelisted object method is allowed', function() {
74			$sandboxView = new SandboxView([
75			'securityPolicy' => new WhitelistSecurityPolicy([
76			'twigTags' => ['set'],
77			'twigMethods' => [
78			Application::class => ['getConfig'],
79			Config::class => ['getGeneral'],
80			GeneralConfig::class => ['devMode'],
81			],
82			'twigProperties' => [
83			CraftVariable::class => ['app'],
84			]
85			]),
86			]);
87			$sandboxView->renderString('{% set dev = craft.app.getConfig().getGeneral().devMode(true) %}');
88			})->throwsNoExceptions();
89
90			test('Whitelisted wildcard object method is allowed', function() {
91			$sandboxView = new SandboxView([
92			'securityPolicy' => new WhitelistSecurityPolicy([
93			'twigTags' => ['set'],
94			'twigMethods' => [
95			Application::class => '*',
96			Config::class => '*',
97			GeneralConfig::class => '*',
98			],
99			'twigProperties' => [
100			CraftVariable::class => ['app'],
101			]
102			]),
103			]);
104			$sandboxView->renderString('{% set dev = craft.app.getConfig().getGeneral().devMode(true) %}');
105			})->throwsNoExceptions();
106
107			test('Non whitelisted object method is not allowed', function() {
108			$sandboxView = new SandboxView([
109			'securityPolicy' => new WhitelistSecurityPolicy([
110			'twigMethods' => [],
111			'twigProperties' => [
112			CraftVariable::class => ['app'],
113			]
114			]),
115			]);
116			$sandboxView->renderString('{{ craft.app.getConfig().getGeneral().getDevMode() }}');
117			})->throws(SecurityNotAllowedMethodError::class);
118
119			test('Whitelisted object property is allowed', function() {
120			$sandboxView = new SandboxView([
121			'securityPolicy' => new WhitelistSecurityPolicy([
122			'twigProperties' => [
123			Application::class => ['config'],
124			Config::class => ['general'],
125			GeneralConfig::class => ['devMode'],
126			CraftVariable::class => ['app'],
127			]
128			]),
129			]);
130			$sandboxView->renderString('{{ craft.app.config.general.devMode }}');
131			})->throwsNoExceptions();
132
133			test('Whitelisted wildcard object property is allowed', function() {
134			$sandboxView = new SandboxView([
135			'securityPolicy' => new WhitelistSecurityPolicy([
136			'twigProperties' => [
137			Application::class => '*',
138			Config::class => '*',
139			GeneralConfig::class => '*',
140			CraftVariable::class => ['app'],
141			]
142			]),
143			]);
144			$sandboxView->renderString('{{ craft.app.config.general.devMode }}');
145			})->throwsNoExceptions();
146
147			test('Non whitelisted object property is not allowed', function() {
148			$sandboxView = new SandboxView([
149			'securityPolicy' => new WhitelistSecurityPolicy([
150			'twigMethods' => [],
151			'twigProperties' => [
152			CraftVariable::class => ['app'],
153			]
154			]),
155			]);
156			$sandboxView->renderString('{{ craft.app.config.general.devMode }}');
157			})->throws(SecurityNotAllowedPropertyError::class);
158

nystudio107 / craft-twig-sandbox

Issues (4)

tests/Feature/WhitelistSecurityPolicyTest.php (1 issue)

Labels

Severity

Introduced By

Duplication Side-by-Side

Filter issues like