DiscoPowerTest::testDiscoPowerReturnUrlDisallowed() - Code Metrics - Inspection of "Update test-framework" - simplesamlphp/simplesamlphp-module-discopower - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Branch — master (0b08c9)

by Tim

created 2023-10-30 16:05 UTC

testDiscoPowerReturnUrlDisallowed() A

↳ Parent: DiscoPowerTest

Complexity

Conditions	1
Paths	1

Size

Total Lines	21
Code Lines	13

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	1
eloc	13
nc	1
nop	0
dl	0
loc	21
rs	9.8333
c	0
b	0
f	0

<?php

declare(strict_types=1);

namespace SimpleSAML\Test\Module\discopower\Controller;

use PHPUnit\Framework\TestCase;
use SimpleSAML\Configuration;
use SimpleSAML\Error;
use SimpleSAML\HTTP\RunnableResponse;
use SimpleSAML\Module\discopower\Controller;
use SimpleSAML\Session;
use SimpleSAML\TestUtils\ClearStateTestCase;
use SimpleSAML\XHTML\Template;
use Symfony\Component\HttpFoundation\Request;

/**
 * Set of tests for the controllers in the "discopwer" module.
 *
 * @covers \SimpleSAML\Module\discopower\Controller\DiscoPower
 */
class DiscoPowerTest extends ClearStateTestCase
{
    /** @var \SimpleSAML\Configuration */
    protected Configuration $config;

    /** @var \SimpleSAML\Configuration */
    protected Configuration $discoconfig;


    /**
     * Set up for each test.
     */
    protected function setUp(): void
    {
        parent::setUp();

        $this->config = Configuration::loadFromArray(
            [
                'module.enable' => ['discopower' => true],
                'trusted.url.domains' => ['example.com'],
            ],
            '[ARRAY]',
            'simplesaml'
        );

        Configuration::setPreLoadedConfig($this->config, 'config.php');

        $this->discoconfig = Configuration::loadFromArray(
            [
                'defaulttab' => 0,
                'trusted.url.domains' => ['example.com'],
            ],
            '[ARRAY]',
            'simplesaml'
        );
    }

    public function testDiscoPowerNoDiscoParams(): void
    {
        $request = Request::create(
            '/disco.php',
            'GET'
        );

        $c = new Controller\DiscoPower();

        $this->expectException(Error\Error::class);
        $this->expectExceptionMessage("DISCOPARAMS");
        $r = $c->main($request);

    }

    public function testDiscoPowerHasDiscoParams(): void
    {
        Configuration::setPreLoadedConfig($this->discoconfig, 'module_discopower.php');

        $request = Request::create(
            '/disco.php',
            'GET',
        );
        $_GET = [
            'entityID' => 'https://example.com/sp',
            'return'=>'https://example.com/acs',
            'returnIDParam' => 'idpentityid'
        ];
        $_SERVER['REQUEST_URI'] = '/disco.php';

        $c = new Controller\DiscoPower();

        $r = $c->main($request);
        $this->assertInstanceOf(RunnableResponse::class, $r);
        $this->assertTrue($r->isSuccessful());
    }

    public function testDiscoPowerReturnUrlDisallowed(): void
    {
        Configuration::setPreLoadedConfig($this->discoconfig, 'module_discopower.php');

        $request = Request::create(
            '/disco.php',
            'GET',
        );
        $_GET = [
            'entityID' => 'https://example.com/sp',
            'return'=>'https://attacker.example.org/acs',
            'returnIDParam' => 'idpentityid'
        ];
        $_SERVER['REQUEST_URI'] = '/disco.php';

        $c = new Controller\DiscoPower();

        // All exceptions in this stage are flattened into DISCOPARAMS
        $this->expectException(Error\Error::class);
        $this->expectExceptionMessage("DISCOPARAMS");
        $r = $c->main($request);

    }

    public function testTablistJson(): void
    {
        $session = Session::getSessionFromRequest();
        $session->setData('discopower:tabList', 'faventry', 'http://example.org/idp');
        $session->setData('discopower:tabList', 'tabs', ['Frankrijk', 'Nederland', 'Duitsland']);
        $session->setData('discopower:tabList', 'defaulttab', 'Nederland');

        $request = Request::create(
            '/tablist',
            'GET'
        );

        $c = new Controller\DiscoPower();

        $r = $c->tablist($request);
        $this->assertTrue($r->isSuccessful());
        $this->assertEquals('application/json', $r->headers->get('Content-Type'));
        $this->assertEquals('{"faventry":"http:\/\/example.org\/idp","default":"Nederland","tabs":["Frankrijk","Nederland","Duitsland"]}', $r->getContent());

        $request = Request::create(
            '/tablist',
            'GET',
            ['callback' => 'aapnoot'],
        );

        $c = new Controller\DiscoPower();

        $r = $c->tablist($request);
        $this->assertTrue($r->isSuccessful());
        $this->assertEquals('text/javascript', $r->headers->get('Content-Type'));
        $this->assertEquals('/**/aapnoot({"faventry":"http:\/\/example.org\/idp","default":"Nederland","tabs":["Frankrijk","Nederland","Duitsland"]});', $r->getContent());
    }

    public function testTablistJsonNoSession(): void
    {
        $request = Request::create(
            '/tablist',
            'GET',
        );

        $c = new Controller\DiscoPower();

        $this->expectException(Error\Exception::class);
        $this->expectExceptionMessage("Could not get tab list from session");
        $r = $c->tablist($request);

    }

    public function testTablistJsonUnsafeCallback(): void
    {
        $session = Session::getSessionFromRequest();
        $session->setData('discopower:tabList', 'faventry', 'http://example.org/idp');
        $session->setData('discopower:tabList', 'tabs', ['Frankrijk', 'Nederland', 'Duitsland']);
        $session->setData('discopower:tabList', 'defaulttab', 'Nederland');

        $request = Request::create(
            '/tablist',
            'GET',
            ['callback' => 'alert("hallo")'],
        );

        $c = new Controller\DiscoPower();

        $this->expectException(Error\Exception::class);
        $this->expectExceptionMessage("Unsafe JSONP callback");
        $r = $c->tablist($request);

    }
}


1			<?php
2
3			declare(strict_types=1);
4
5			namespace SimpleSAML\Test\Module\discopower\Controller;
6
7			use PHPUnit\Framework\TestCase;
8			use SimpleSAML\Configuration;
9			use SimpleSAML\Error;
10			use SimpleSAML\HTTP\RunnableResponse;
11			use SimpleSAML\Module\discopower\Controller;
12			use SimpleSAML\Session;
13			use SimpleSAML\TestUtils\ClearStateTestCase;
14			use SimpleSAML\XHTML\Template;
15			use Symfony\Component\HttpFoundation\Request;
16
17			/**
18			* Set of tests for the controllers in the "discopwer" module.
19			*
20			* @covers \SimpleSAML\Module\discopower\Controller\DiscoPower
21			*/
22			class DiscoPowerTest extends ClearStateTestCase
23			{
24			/** @var \SimpleSAML\Configuration */
25			protected Configuration $config;
26
27			/** @var \SimpleSAML\Configuration */
28			protected Configuration $discoconfig;
29
30
31			/**
32			* Set up for each test.
33			*/
34			protected function setUp(): void
35			{
36			parent::setUp();
37
38			$this->config = Configuration::loadFromArray(
39			[
40			'module.enable' => ['discopower' => true],
41			'trusted.url.domains' => ['example.com'],
42			],
43			'[ARRAY]',
44			'simplesaml'
45			);
46
47			Configuration::setPreLoadedConfig($this->config, 'config.php');
48
49			$this->discoconfig = Configuration::loadFromArray(
50			[
51			'defaulttab' => 0,
52			'trusted.url.domains' => ['example.com'],
53			],
54			'[ARRAY]',
55			'simplesaml'
56			);
57			}
58
59			public function testDiscoPowerNoDiscoParams(): void
60			{
61			$request = Request::create(
62			'/disco.php',
63			'GET'
64			);
65
66			$c = new Controller\DiscoPower();
67
68			$this->expectException(Error\Error::class);
69			$this->expectExceptionMessage("DISCOPARAMS");
70			$r = $c->main($request);
			0 ignored issues – show Unused Code introduced 2023-10-30 16:21 UTC by Report Bug Copy Issue Report The assignment to `$r` is dead and can be removed. Loading history...
71			}
72
73			public function testDiscoPowerHasDiscoParams(): void
74			{
75			Configuration::setPreLoadedConfig($this->discoconfig, 'module_discopower.php');
76
77			$request = Request::create(
78			'/disco.php',
79			'GET',
80			);
81			$_GET = [
82			'entityID' => 'https://example.com/sp',
83			'return'=>'https://example.com/acs',
84			'returnIDParam' => 'idpentityid'
85			];
86			$_SERVER['REQUEST_URI'] = '/disco.php';
87
88			$c = new Controller\DiscoPower();
89
90			$r = $c->main($request);
91			$this->assertInstanceOf(RunnableResponse::class, $r);
92			$this->assertTrue($r->isSuccessful());
93			}
94
95			public function testDiscoPowerReturnUrlDisallowed(): void
96			{
97			Configuration::setPreLoadedConfig($this->discoconfig, 'module_discopower.php');
98
99			$request = Request::create(
100			'/disco.php',
101			'GET',
102			);
103			$_GET = [
104			'entityID' => 'https://example.com/sp',
105			'return'=>'https://attacker.example.org/acs',
106			'returnIDParam' => 'idpentityid'
107			];
108			$_SERVER['REQUEST_URI'] = '/disco.php';
109
110			$c = new Controller\DiscoPower();
111
112			// All exceptions in this stage are flattened into DISCOPARAMS
113			$this->expectException(Error\Error::class);
114			$this->expectExceptionMessage("DISCOPARAMS");
115			$r = $c->main($request);
			0 ignored issues – show Unused Code introduced 2023-10-30 16:21 UTC by Report Bug Copy Issue Report The assignment to `$r` is dead and can be removed. Loading history...
116			}
117
118			public function testTablistJson(): void
119			{
120			$session = Session::getSessionFromRequest();
121			$session->setData('discopower:tabList', 'faventry', 'http://example.org/idp');
122			$session->setData('discopower:tabList', 'tabs', ['Frankrijk', 'Nederland', 'Duitsland']);
123			$session->setData('discopower:tabList', 'defaulttab', 'Nederland');
124
125			$request = Request::create(
126			'/tablist',
127			'GET'
128			);
129
130			$c = new Controller\DiscoPower();
131
132			$r = $c->tablist($request);
133			$this->assertTrue($r->isSuccessful());
134			$this->assertEquals('application/json', $r->headers->get('Content-Type'));
135			$this->assertEquals('{"faventry":"http:\/\/example.org\/idp","default":"Nederland","tabs":["Frankrijk","Nederland","Duitsland"]}', $r->getContent());
136
137			$request = Request::create(
138			'/tablist',
139			'GET',
140			['callback' => 'aapnoot'],
141			);
142
143			$c = new Controller\DiscoPower();
144
145			$r = $c->tablist($request);
146			$this->assertTrue($r->isSuccessful());
147			$this->assertEquals('text/javascript', $r->headers->get('Content-Type'));
148			$this->assertEquals('/**/aapnoot({"faventry":"http:\/\/example.org\/idp","default":"Nederland","tabs":["Frankrijk","Nederland","Duitsland"]});', $r->getContent());
149			}
150
151			public function testTablistJsonNoSession(): void
152			{
153			$request = Request::create(
154			'/tablist',
155			'GET',
156			);
157
158			$c = new Controller\DiscoPower();
159
160			$this->expectException(Error\Exception::class);
161			$this->expectExceptionMessage("Could not get tab list from session");
162			$r = $c->tablist($request);
			0 ignored issues – show Unused Code introduced 2023-10-30 16:21 UTC by Report Bug Copy Issue Report The assignment to `$r` is dead and can be removed. Loading history...
163			}
164
165			public function testTablistJsonUnsafeCallback(): void
166			{
167			$session = Session::getSessionFromRequest();
168			$session->setData('discopower:tabList', 'faventry', 'http://example.org/idp');
169			$session->setData('discopower:tabList', 'tabs', ['Frankrijk', 'Nederland', 'Duitsland']);
170			$session->setData('discopower:tabList', 'defaulttab', 'Nederland');
171
172			$request = Request::create(
173			'/tablist',
174			'GET',
175			['callback' => 'alert("hallo")'],
176			);
177
178			$c = new Controller\DiscoPower();
179
180			$this->expectException(Error\Exception::class);
181			$this->expectExceptionMessage("Unsafe JSONP callback");
182			$r = $c->tablist($request);
			0 ignored issues – show Unused Code introduced 2023-10-30 16:21 UTC by Report Bug Copy Issue Report The assignment to `$r` is dead and can be removed. Loading history...
183			}
184			}
185

simplesamlphp / simplesamlphp-module-discopower

Branch — master (0b08c9)

testDiscoPowerReturnUrlDisallowed() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like