CorsServiceTest::testAppendVaryHeaderInNormalRequest() - Code Metrics - zf-fr/zfr-cors - Measure and Improve Code Quality continuously with Scrutinizer

testAppendVaryHeaderInNormalRequest() A
last analyzed 2020-01-03 11:33 UTC

↳ Parent: CorsServiceTest
Complexity

Conditions	1
Paths	1
Size

Total Lines
Duplication

Lines	0
Ratio	0 %
Importance

Changes
Metric	Value
dl	0
loc	14
c	0
b	0
f	0
rs	9.7998
cc	1
nc	1
nop	0
<?php
/*
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * This software consists of voluntary contributions made by many individuals
 * and is licensed under the MIT license.
 */

namespace ZfrCorsTest\Service;

use PHPUnit\Framework\TestCase as TestCase;
use Zend\Http\Response as HttpResponse;
use Zend\Http\Request as HttpRequest;
use Zend\Mvc\MvcEvent;
use Zend\Mvc\Router\Http\RouteMatch as DeprecatedRouteMatch;
use Zend\Router\Http\RouteMatch;
use ZfrCors\Options\CorsOptions;
use ZfrCors\Service\CorsService;

/**
 * Integration tests for {@see \ZfrCors\Service\CorsService}
 *
 * @author Florent Blaison <[email protected]>
 *
 * @covers \ZfrCors\Service\CorsService
 * @group Coverage
 */
class CorsServiceTest extends TestCase
{
    /**
     * @var CorsService
     */
    protected $corsService;

    /**
     * @var HttpResponse
     */
    protected $response;

    /**
     * @var HttpRequest
     */
    protected $request;

    /**
     * @var MvcEvent
     */
    protected $event;

    /**
     * @var CorsOptions
     */
    protected $corsOptions;

    /**
     * Set up
     */
    public function setUp(): void
    {
        parent::setUp();

        $this->corsOptions = new CorsOptions(
            [
                'allowed_origins'     => ['http://example.com'],
                'allowed_methods'     => ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
                'allowed_headers'     => ['Content-Type', 'Accept'],
                'exposed_headers'     => ['Location'],
                'max_age'             => 10,
                'allowed_credentials' => true,
            ]
        );

        $this->corsService = new CorsService($this->corsOptions);
    }

    public function testCanDetectCorsRequest()
    {
        $request = new HttpRequest();

        $this->assertFalse($this->corsService->isCorsRequest($request));

        $request->getHeaders()->addHeaderLine('Origin', 'http://example.com');
        $this->assertEquals(true, $this->corsService->isCorsRequest($request));
    }

    public function testIsNotCorsRequestIfNotACrossRequest()
    {
        $request = new HttpRequest();
        $request->setUri('http://example.com');

        $request->getHeaders()->addHeaderLine('Origin', 'http://example.com');
        $this->assertEquals(false, $this->corsService->isCorsRequest($request));
    }

    public function testCanDetectPreflightRequest()
    {
        $request = new HttpRequest();

        $this->assertFalse($this->corsService->isPreflightRequest($request));

        $request->setMethod('OPTIONS');
        $this->assertFalse($this->corsService->isPreflightRequest($request));

        $request->getHeaders()->addHeaderLine('Origin', 'http://example.com');
        $this->assertFalse($this->corsService->isPreflightRequest($request));

        $request->getHeaders()->addHeaderLine('Access-Control-Request-Method', 'POST');
        $this->assertTrue($this->corsService->isPreflightRequest($request));
    }

    public function testProperlyCreatePreflightResponse()
    {
        $request  = new HttpRequest();
        $request->getHeaders()->addHeaderLine('Origin', 'http://example.com');

        $response = $this->corsService->createPreflightCorsResponse($request);

        $headers = $response->getHeaders();

        $this->assertEquals(200, $response->getStatusCode());
        $this->assertEquals('', $response->getContent());
        $this->assertEquals('http://example.com', $headers->get('Access-Control-Allow-Origin')->getFieldValue());
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
        $this->assertEquals(
            'GET, POST, PUT, DELETE, OPTIONS',
            $headers->get('Access-Control-Allow-Methods')->getFieldValue()
        );
        $this->assertEquals('Content-Type, Accept', $headers->get('Access-Control-Allow-Headers')->getFieldValue());
        $this->assertEquals(10, $headers->get('Access-Control-Max-Age')->getFieldValue());
        $this->assertEquals(0, $headers->get('Content-Length')->getFieldValue());

        $this->assertEquals('true', $headers->get('Access-Control-Allow-Credentials')->getFieldValue());
    }

    public function testDoesNotAddAllowCredentialsHeadersIfAsked()
    {
        $request  = new HttpRequest();
        $request->getHeaders()->addHeaderLine('Origin', 'http://example.com');
        $this->corsOptions->setAllowedCredentials(false);

        $response = $this->corsService->createPreflightCorsResponse($request);

        $headers = $response->getHeaders();
        $this->assertFalse($headers->has('Access-Control-Allow-Credentials'));
    }

    public function testCanReturnWildCardAllowOrigin()
    {
        $request  = new HttpRequest();
        $request->getHeaders()->addHeaderLine('Origin', 'http://funny-origin.com');
        $this->corsOptions->setAllowedOrigins(['*']);

        $response = $this->corsService->createPreflightCorsResponse($request);

        $headers = $response->getHeaders();
        $this->assertEquals('http://funny-origin.com', $headers->get('Access-Control-Allow-Origin')->getFieldValue());
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
    }

    public function testCanReturnWildCardSubDomainAllowOrigin()
    {
        $request  = new HttpRequest();
        $request->getHeaders()->addHeaderLine('Origin', 'http://subdomain.example.com');
        $this->corsOptions->setAllowedOrigins(['*.example.com']);

        $response = $this->corsService->createPreflightCorsResponse($request);

        $headers = $response->getHeaders();
        $headerValue = $headers->get('Access-Control-Allow-Origin')->getFieldValue();
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
        $this->assertEquals('http://subdomain.example.com', $headerValue);
    }

    public function testCanReturnWildCardSubDomainWithSchemeAllowOrigin()
    {
        $request  = new HttpRequest();
        $request->getHeaders()->addHeaderLine('Origin', 'https://subdomain.example.com');
        $this->corsOptions->setAllowedOrigins(['https://*.example.com']);

        $response = $this->corsService->createPreflightCorsResponse($request);

        $headers = $response->getHeaders();
        $headerValue = $headers->get('Access-Control-Allow-Origin')->getFieldValue();
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
        $this->assertEquals('https://subdomain.example.com', $headerValue);
    }

    public function testReturnNullForMissMatchedWildcardSubDomainOrigin()
    {
        $request  = new HttpRequest();
        $request->getHeaders()->addHeaderLine('Origin', 'http://subdomain.example.org');
        $this->corsOptions->setAllowedOrigins(['*.example.com']);

        $response = $this->corsService->createPreflightCorsResponse($request);

        $headers = $response->getHeaders();
        $this->assertEquals('null', $headers->get('Access-Control-Allow-Origin')->getFieldValue());
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
    }

    public function testReturnNullForRootDomainOnWildcardSubDomainOrigin()
    {
        $request  = new HttpRequest();
        $request->getHeaders()->addHeaderLine('Origin', 'http://example.com');
        $this->corsOptions->setAllowedOrigins(['*.example.com']);

        $response = $this->corsService->createPreflightCorsResponse($request);

        $headers = $response->getHeaders();
        $this->assertEquals('null', $headers->get('Access-Control-Allow-Origin')->getFieldValue());
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
    }

    public function testReturnNullForDifferentSchemeOnWildcardSubDomainOrigin()
    {
        $request  = new HttpRequest();
        $request->getHeaders()->addHeaderLine('Origin', 'https://example.com');
        $this->corsOptions->setAllowedOrigins(['http://*.example.com']);

        $response = $this->corsService->createPreflightCorsResponse($request);

        $headers = $response->getHeaders();
        $this->assertEquals('null', $headers->get('Access-Control-Allow-Origin')->getFieldValue());
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
    }

    public function testReturnNullForUnknownOrigin()
    {
        $request  = new HttpRequest();
        $request->getHeaders()->addHeaderLine('Origin', 'http://unauthorized-origin.com');

        $response = $this->corsService->createPreflightCorsResponse($request);

        $headers = $response->getHeaders();
        $this->assertEquals('null', $headers->get('Access-Control-Allow-Origin')->getFieldValue());
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
    }

    public function testEnsureVaryHeaderForNoOrigin()
    {
        $response = new HttpResponse();

        $this->corsService->ensureVaryHeader($response);

        $headers = $response->getHeaders();

        $this->assertFalse($headers->get('Origin'));
        $this->assertNotFalse($headers->get('Vary'));
        $this->assertContains('Origin', $headers->get('Vary')->getFieldValue());
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
    }

    public function testEnsureNoVaryHeaderWhenAcceptsAnyOrigin()
    {
        $response = new HttpResponse();
        $corsService = new CorsService(new CorsOptions([
            'allowed_origins' => ['*']
        ]));

        $corsService->ensureVaryHeader($response);

        $headers = $response->getHeaders();

        $this->assertFalse($headers->get('Origin'));
        $this->assertFalse($headers->get('Vary'));
    }

    public function testCanPopulateNormalCorsRequest()
    {
        $request  = new HttpRequest();
        $response = new HttpResponse();

        $request->getHeaders()->addHeaderLine('Origin', 'http://example.com');

        $this->corsService->populateCorsResponse($request, $response);

        $headers = $response->getHeaders();

        $this->assertEquals('http://example.com', $headers->get('Access-Control-Allow-Origin')->getFieldValue());
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
        $this->assertEquals('Location', $headers->get('Access-Control-Expose-Headers')->getFieldValue());
    }

    public function testRefuseNormalCorsRequestIfUnauthorized()
    {
        $request  = new HttpRequest();
        $response = new HttpResponse();

        $request->getHeaders()->addHeaderLine('Origin', 'http://unauthorized.com');

        $this->expectException(\ZfrCors\Exception\DisallowedOriginException::class);
        $this->expectExceptionMessage('The origin "http://unauthorized.com" is not authorized');

        $this->corsService->populateCorsResponse($request, $response);
    }

    public function testAddVaryHeaderInNormalRequest()
    {
        $request  = new HttpRequest();
        $response = new HttpResponse();

        $request->getHeaders()->addHeaderLine('Origin', 'http://example.com');

        $this->corsService->populateCorsResponse($request, $response);

        $headers = $response->getHeaders();
        $this->assertTrue($headers->has('Vary'));
    }

    public function testAppendVaryHeaderInNormalRequest()
    {
        $request  = new HttpRequest();
        $response = new HttpResponse();

        $request->getHeaders()->addHeaderLine('Origin', 'http://example.com');
        $response->getHeaders()->addHeaderLine('Vary', 'Foo');

        $this->corsService->populateCorsResponse($request, $response);

        $headers = $response->getHeaders();
        $this->assertTrue($headers->has('Vary'));
        $this->assertEquals('Foo, Origin', $headers->get('Vary')->getFieldValue());
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
    }

    public function testPopulatesAllowCredentialsNormalCorsRequest()
    {
        $request  = new HttpRequest();
        $response = new HttpResponse();

        $request->getHeaders()->addHeaderLine('Origin', 'http://example.com');

        $this->corsService->populateCorsResponse($request, $response);

        $headers = $response->getHeaders();

        $this->assertEquals('true', $headers->get('Access-Control-Allow-Credentials')->getFieldValue());
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
    }

    public function testCanDetectCorsRequestFromSameHostButDifferentPort()
    {
        $request = new HttpRequest();
        $request->setUri('http://example.com');
        $request->getHeaders()->addHeaderLine('Origin', 'http://example.com:9000');
        $this->assertTrue($this->corsService->isCorsRequest($request));
    }

    public function testCanDetectCorsRequestFromSameHostButDifferentScheme()
    {
        $request = new HttpRequest();
        $request->setUri('https://example.com');
        $request->getHeaders()->addHeaderLine('Origin', 'http://example.com');
        $this->assertTrue($this->corsService->isCorsRequest($request));
    }

    public function testCanHandleUnconfiguredRouteMatch()
    {
        $routeMatch = class_exists(DeprecatedRouteMatch::class) ? new DeprecatedRouteMatch([]) : new RouteMatch([]);

        $request = new HttpRequest();
        $request->getHeaders()->addHeaderLine('Origin', 'http://example.com');
        $response = $this->corsService->createPreflightCorsResponseWithRouteOptions($request, $routeMatch);

        $headers = $response->getHeaders();

        $this->assertEquals(200, $response->getStatusCode());
        $this->assertEquals('', $response->getContent());
        $this->assertEquals('http://example.com', $headers->get('Access-Control-Allow-Origin')->getFieldValue());
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
        $this->assertEquals(
            'GET, POST, PUT, DELETE, OPTIONS',
            $headers->get('Access-Control-Allow-Methods')->getFieldValue()
        );
        $this->assertEquals('Content-Type, Accept', $headers->get('Access-Control-Allow-Headers')->getFieldValue());
        $this->assertEquals(10, $headers->get('Access-Control-Max-Age')->getFieldValue());
        $this->assertEquals(0, $headers->get('Content-Length')->getFieldValue());

        $this->assertEquals('true', $headers->get('Access-Control-Allow-Credentials')->getFieldValue());
    }

    public function testCanHandleConfiguredRouteMatch()
    {

        $routeMatchParameters = [
            CorsOptions::ROUTE_PARAM => [
                'allowed_origins'     => ['http://example.org'],
                'allowed_methods'     => ['POST', 'DELETE', 'OPTIONS'],
                'allowed_headers'     => ['Content-Type', 'Accept', 'Cookie'],
                'exposed_headers'     => ['Location'],
                'max_age'             => 5,
                'allowed_credentials' => false,
            ],
        ];

        $routeMatch = class_exists(DeprecatedRouteMatch::class) ? new DeprecatedRouteMatch($routeMatchParameters) :
            new RouteMatch($routeMatchParameters);

        $request = new HttpRequest();
        $request->getHeaders()->addHeaderLine('Origin', 'http://example.org');
        $response = $this->corsService->createPreflightCorsResponseWithRouteOptions($request, $routeMatch);

        $headers = $response->getHeaders();
        $this->assertEquals(200, $response->getStatusCode());
        $this->assertEquals('', $response->getContent());
        $this->assertEquals('http://example.org', $headers->get('Access-Control-Allow-Origin')->getFieldValue());
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
        $this->assertEquals(
            'POST, DELETE, OPTIONS',
            $headers->get('Access-Control-Allow-Methods')->getFieldValue()
        );
        $this->assertEquals(
            'Content-Type, Accept, Cookie',
            $headers->get('Access-Control-Allow-Headers')->getFieldValue()
        );
        $this->assertEquals(5, $headers->get('Access-Control-Max-Age')->getFieldValue());
        $this->assertEquals(0, $headers->get('Content-Length')->getFieldValue());

        $this->assertFalse($headers->has('Access-Control-Allow-Credentials'));
    }

    /**
     * @see https://github.com/zf-fr/zfr-cors/issues/44
     */
    public function testDoesNotCrashApplicationOnInvalidOriginValue()
    {
        $request = new HttpRequest();
        $request->setUri('https://example.com');
        $request->getHeaders()->addHeaderLine('Origin', 'file:');
        $this->expectException(\ZfrCors\Exception\InvalidOriginException::class);
        $this->corsService->isCorsRequest($request);
    }

    /**
     * @see https://github.com/zf-fr/zfr-cors/issues/57
     */
    public function testCanPopulateNormalCorsRequestWithRouteMatch()
    {
        $request  = new HttpRequest();
        $response = new HttpResponse();
        $routeMatchParameters = [
            CorsOptions::ROUTE_PARAM => [
                'allowed_origins'     => ['http://example.org']
            ],
        ];

        $routeMatch = class_exists(DeprecatedRouteMatch::class) ? new DeprecatedRouteMatch($routeMatchParameters) :
            new RouteMatch($routeMatchParameters);

        $request->getHeaders()->addHeaderLine('Origin', 'http://example.org');

        $response = $this->corsService->populateCorsResponse($request, $response, $routeMatch);
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}
        $this->assertInstanceOf(\Zend\Http\Response::class, $response);
        $this->assertEquals(
            'http://example.org',
            $response->getHeaders()->get('Access-Control-Allow-Origin')->getFieldValue()
class A
{
    public function foo() { }
}

class B extends A
{
    public function bar() { }
}

/**
 * @param A|B $x
 */
function someFunction($x)
{
    $x->foo(); // This call is fine as the method exists in A and B.
    $x->bar(); // This method only exists in B and might cause an error.
}
        );
    }

    /**
     * @see https://github.com/zf-fr/zfr-cors/issues/57
     */
    public function testCanPopulateNormalCorsRequestWithRouteMatchRewriteException()
    {
        $request  = new HttpRequest();
        $response = new HttpResponse();
        $routeMatchParameters = [
            CorsOptions::ROUTE_PARAM => [
                'allowed_origins'     => ['http://example.org']
            ],
        ];

        $routeMatch = class_exists(DeprecatedRouteMatch::class) ? new DeprecatedRouteMatch($routeMatchParameters) :
            new RouteMatch($routeMatchParameters);

        $request->getHeaders()->addHeaderLine('Origin', 'http://example.com');

        $this->expectException(\ZfrCors\Exception\DisallowedOriginException::class);
        $this->corsService->populateCorsResponse($request, $response, $routeMatch);
/**
 * @return array|string
 */
function returnsDifferentValues($x) {
    if ($x) {
        return 'foo';
    }

    return array();
}

$x = returnsDifferentValues($y);
if (is_array($x)) {
    // $x is an array.
}
    }
}

testAppendVaryHeaderInNormalRequest() A
last analyzed 2020-01-03 11:33 UTC

Complexity

Size

Duplication

Importance

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

zf-fr / zfr-cors

testAppendVaryHeaderInNormalRequest() A last analyzed 2020-01-03 11:33 UTC

Complexity

Size

Duplication

Importance

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Available Fixes

Duplication Side-by-Side

Filter issues like

testAppendVaryHeaderInNormalRequest() A
last analyzed 2020-01-03 11:33 UTC
