updated core to 8.6.2

2018-10-23 11:50:40 +02:00
parent afcb9d9c34
commit 5c71ef4c46
34 changed files with 1083 additions and 566 deletions
@@ -563,6 +563,10 @@ class UrlHelperTest extends TestCase {
      ['http://example.com/foo', 'http://example.com/bar', FALSE],
      ['http://example.com', 'http://example.com/bar', FALSE],
      ['http://example.com/bar', 'http://example.com/bar/', FALSE],
+      // Ensure \ is normalised to / since some browsers do that.
+      ['http://www.example.ca\@example.com', 'http://example.com', FALSE],
+      // Some browsers ignore or strip leading control characters.
+      ["\x00//www.example.ca", 'http://example.com', FALSE],
    ];
  }

@@ -11,7 +11,6 @@ use Symfony\Component\EventDispatcher\EventDispatcher;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Event\FilterResponseEvent;
-use Symfony\Component\HttpKernel\Event\GetResponseEvent;
 use Symfony\Component\HttpKernel\HttpKernelInterface;
 use Symfony\Component\HttpKernel\KernelEvents;

@@ -192,74 +191,4 @@ class RedirectResponseSubscriberTest extends UnitTestCase {
    return $data;
  }

-  /**
-   * Tests that $_GET only contain internal URLs.
-   *
-   * @covers ::sanitizeDestination
-   *
-   * @dataProvider providerTestSanitizeDestination
-   *
-   * @see \Drupal\Component\Utility\UrlHelper::isExternal
-   */
-  public function testSanitizeDestinationForGet($input, $output) {
-    $request = new Request();
-    $request->query->set('destination', $input);
-
-    $listener = new RedirectResponseSubscriber($this->urlAssembler, $this->requestContext);
-    $kernel = $this->getMock('Symfony\Component\HttpKernel\HttpKernelInterface');
-    $event = new GetResponseEvent($kernel, $request, HttpKernelInterface::MASTER_REQUEST);
-
-    $dispatcher = new EventDispatcher();
-    $dispatcher->addListener(KernelEvents::REQUEST, [$listener, 'sanitizeDestination'], 100);
-    $dispatcher->dispatch(KernelEvents::REQUEST, $event);
-
-    $this->assertEquals($output, $request->query->get('destination'));
-  }
-
-  /**
-   * Tests that $_REQUEST['destination'] only contain internal URLs.
-   *
-   * @covers ::sanitizeDestination
-   *
-   * @dataProvider providerTestSanitizeDestination
-   *
-   * @see \Drupal\Component\Utility\UrlHelper::isExternal
-   */
-  public function testSanitizeDestinationForPost($input, $output) {
-    $request = new Request();
-    $request->request->set('destination', $input);
-
-    $listener = new RedirectResponseSubscriber($this->urlAssembler, $this->requestContext);
-    $kernel = $this->getMock('Symfony\Component\HttpKernel\HttpKernelInterface');
-    $event = new GetResponseEvent($kernel, $request, HttpKernelInterface::MASTER_REQUEST);
-
-    $dispatcher = new EventDispatcher();
-    $dispatcher->addListener(KernelEvents::REQUEST, [$listener, 'sanitizeDestination'], 100);
-    $dispatcher->dispatch(KernelEvents::REQUEST, $event);
-
-    $this->assertEquals($output, $request->request->get('destination'));
-  }
-
-  /**
-   * Data provider for testSanitizeDestination().
-   */
-  public function providerTestSanitizeDestination() {
-    $data = [];
-    // Standard internal example node path is present in the 'destination'
-    // parameter.
-    $data[] = ['node', 'node'];
-    // Internal path with one leading slash is allowed.
-    $data[] = ['/example.com', '/example.com'];
-    // External URL without scheme is not allowed.
-    $data[] = ['//example.com/test', ''];
-    // Internal URL using a colon is allowed.
-    $data[] = ['example:test', 'example:test'];
-    // External URL is not allowed.
-    $data[] = ['http://example.com', ''];
-    // Javascript URL is allowed because it is treated as an internal URL.
-    $data[] = ['javascript:alert(0)', 'javascript:alert(0)'];
-
-    return $data;
-  }
-
 }
@@ -7,6 +7,7 @@

 namespace Drupal\Tests\Core\Mail;

+use Drupal\Core\DependencyInjection\ContainerBuilder;
 use Drupal\Core\Render\RenderContext;
 use Drupal\Core\Render\RendererInterface;
 use Drupal\Tests\UnitTestCase;
@@ -103,6 +104,9 @@ class MailManagerTest extends UnitTestCase {
      'system.mail' => [
        'interface' => $interface,
      ],
+      'system.site' => [
+        'mail' => 'test@example.com',
+      ],
    ]);
    $logger_factory = $this->getMock('\Drupal\Core\Logger\LoggerChannelFactoryInterface');
    $string_translation = $this->getStringTranslationStub();
@@ -110,6 +114,11 @@ class MailManagerTest extends UnitTestCase {
    // Construct the manager object and override its discovery.
    $this->mailManager = new TestMailManager(new \ArrayObject(), $this->cache, $this->moduleHandler, $this->configFactory, $logger_factory, $string_translation, $this->renderer);
    $this->mailManager->setDiscovery($this->discovery);
+
+    // @see \Drupal\Core\Plugin\Factory\ContainerFactory::createInstance()
+    $container = new ContainerBuilder();
+    $container->set('config.factory', $this->configFactory);
+    \Drupal::setContainer($container);
  }

  /**
@@ -197,6 +197,147 @@ class RequestSanitizerTest extends UnitTestCase {
    return $tests;
  }

+  /**
+   * Tests acceptable destinations are not removed from GET requests.
+   *
+   * @param string $destination
+   *   The destination string to test.
+   *
+   * @dataProvider providerTestAcceptableDestinations
+   */
+  public function testAcceptableDestinationGet($destination) {
+    // Set up a GET request.
+    $request = $this->createRequestForTesting(['destination' => $destination]);
+
+    $request = RequestSanitizer::sanitize($request, [], TRUE);
+
+    $this->assertSame($destination, $request->query->get('destination', NULL));
+    $this->assertNull($request->request->get('destination', NULL));
+    $this->assertSame($destination, $_GET['destination']);
+    $this->assertSame($destination, $_REQUEST['destination']);
+    $this->assertArrayNotHasKey('destination', $_POST);
+    $this->assertEquals([], $this->errors);
+  }
+
+  /**
+   * Tests unacceptable destinations are removed from GET requests.
+   *
+   * @param string $destination
+   *   The destination string to test.
+   *
+   * @dataProvider providerTestSanitizedDestinations
+   */
+  public function testSanitizedDestinationGet($destination) {
+    // Set up a GET request.
+    $request = $this->createRequestForTesting(['destination' => $destination]);
+
+    $request = RequestSanitizer::sanitize($request, [], TRUE);
+
+    $this->assertNull($request->request->get('destination', NULL));
+    $this->assertNull($request->query->get('destination', NULL));
+    $this->assertArrayNotHasKey('destination', $_POST);
+    $this->assertArrayNotHasKey('destination', $_REQUEST);
+    $this->assertArrayNotHasKey('destination', $_GET);
+    $this->assertError('Potentially unsafe destination removed from query parameter bag because it points to an external URL.', E_USER_NOTICE);
+  }
+
+  /**
+   * Tests acceptable destinations are not removed from POST requests.
+   *
+   * @param string $destination
+   *   The destination string to test.
+   *
+   * @dataProvider providerTestAcceptableDestinations
+   */
+  public function testAcceptableDestinationPost($destination) {
+    // Set up a POST request.
+    $request = $this->createRequestForTesting([], ['destination' => $destination]);
+
+    $request = RequestSanitizer::sanitize($request, [], TRUE);
+
+    $this->assertSame($destination, $request->request->get('destination', NULL));
+    $this->assertNull($request->query->get('destination', NULL));
+    $this->assertSame($destination, $_POST['destination']);
+    $this->assertSame($destination, $_REQUEST['destination']);
+    $this->assertArrayNotHasKey('destination', $_GET);
+    $this->assertEquals([], $this->errors);
+  }
+
+  /**
+   * Tests unacceptable destinations are removed from GET requests.
+   *
+   * @param string $destination
+   *   The destination string to test.
+   *
+   * @dataProvider providerTestSanitizedDestinations
+   */
+  public function testSanitizedDestinationPost($destination) {
+    // Set up a POST request.
+    $request = $this->createRequestForTesting([], ['destination' => $destination]);
+
+    $request = RequestSanitizer::sanitize($request, [], TRUE);
+
+    $this->assertNull($request->request->get('destination', NULL));
+    $this->assertNull($request->query->get('destination', NULL));
+    $this->assertArrayNotHasKey('destination', $_POST);
+    $this->assertArrayNotHasKey('destination', $_REQUEST);
+    $this->assertArrayNotHasKey('destination', $_GET);
+    $this->assertError('Potentially unsafe destination removed from request parameter bag because it points to an external URL.', E_USER_NOTICE);
+  }
+
+  /**
+   * Creates a request and sets PHP globals for testing.
+   *
+   * @param array $query
+   *   (optional) The GET parameters.
+   * @param array $request
+   *   (optional) The POST parameters.
+   *
+   * @return \Symfony\Component\HttpFoundation\Request
+   *   The request object.
+   */
+  protected function createRequestForTesting(array $query = [], array $request = []) {
+    $request = new Request($query, $request);
+
+    // Set up globals.
+    $_GET = $request->query->all();
+    $_POST = $request->request->all();
+    $_COOKIE = $request->cookies->all();
+    $_REQUEST = array_merge($request->query->all(), $request->request->all());
+    $request->server->set('QUERY_STRING', http_build_query($request->query->all()));
+    $_SERVER['QUERY_STRING'] = $request->server->get('QUERY_STRING');
+    return $request;
+  }
+
+  /**
+   * Data provider for testing acceptable destinations.
+   */
+  public function providerTestAcceptableDestinations() {
+    $data = [];
+    // Standard internal example node path is present in the 'destination'
+    // parameter.
+    $data[] = ['node'];
+    // Internal path with one leading slash is allowed.
+    $data[] = ['/example.com'];
+    // Internal URL using a colon is allowed.
+    $data[] = ['example:test'];
+    // Javascript URL is allowed because it is treated as an internal URL.
+    $data[] = ['javascript:alert(0)'];
+    return $data;
+  }
+
+  /**
+   * Data provider for testing sanitized destinations.
+   */
+  public function providerTestSanitizedDestinations() {
+    $data = [];
+    // External URL without scheme is not allowed.
+    $data[] = ['//example.com/test'];
+    // External URL is not allowed.
+    $data[] = ['http://example.com'];
+    return $data;
+  }
+
  /**
   * Catches and logs errors to $this->errors.
   *