Security update for Core, with self-updated composer
[yaffs-website] / web / core / tests / Drupal / Tests / Core / Routing / TrustedRedirectResponseTest.php
1 <?php
2
3 namespace Drupal\Tests\Core\Routing;
4
5 use Drupal\Core\Cache\CacheableMetadata;
6 use Drupal\Core\Cache\CacheableRedirectResponse;
7 use Drupal\Core\Cache\CacheableResponseInterface;
8 use Drupal\Core\Routing\RequestContext;
9 use Drupal\Core\Routing\TrustedRedirectResponse;
10 use Drupal\Tests\UnitTestCase;
11 use Symfony\Component\DependencyInjection\ContainerBuilder;
12 use Symfony\Component\HttpFoundation\RedirectResponse;
13
14 /**
15  * @coversDefaultClass \Drupal\Core\Routing\TrustedRedirectResponse
16  * @group Routing
17  */
18 class TrustedRedirectResponseTest extends UnitTestCase {
19
20   /**
21    * @covers ::setTargetUrl
22    */
23   public function testSetTargetUrlWithInternalUrl() {
24     $redirect_response = new TrustedRedirectResponse('/example');
25     $redirect_response->setTargetUrl('/example2');
26
27     $this->assertEquals('/example2', $redirect_response->getTargetUrl());
28   }
29
30   /**
31    * @covers ::setTargetUrl
32    */
33   public function testSetTargetUrlWithUntrustedUrl() {
34     $request_context = new RequestContext();
35     $request_context->setCompleteBaseUrl('https://www.drupal.org');
36     $container = new ContainerBuilder();
37     $container->set('router.request_context', $request_context);
38     \Drupal::setContainer($container);
39
40     $redirect_response = new TrustedRedirectResponse('/example');
41
42     $this->setExpectedException(\InvalidArgumentException::class);
43     $redirect_response->setTargetUrl('http://evil-url.com/example');
44   }
45
46   /**
47    * @covers ::setTargetUrl
48    */
49   public function testSetTargetUrlWithTrustedUrl() {
50     $redirect_response = new TrustedRedirectResponse('/example');
51
52     $redirect_response->setTrustedTargetUrl('http://good-external-url.com/example');
53     $this->assertEquals('http://good-external-url.com/example', $redirect_response->getTargetUrl());
54   }
55
56   /**
57    * @covers ::createFromRedirectResponse
58    * @dataProvider providerCreateFromRedirectResponse
59    */
60   public function testCreateFromRedirectResponse($redirect_response) {
61     $trusted_redirect_response = TrustedRedirectResponse::createFromRedirectResponse($redirect_response);
62
63     // The trusted redirect response is always a CacheableResponseInterface instance.
64     $this->assertTrue($trusted_redirect_response instanceof CacheableResponseInterface);
65
66     // But it is only actually cacheable (non-zero max-age) if the redirect
67     // response passed to TrustedRedirectResponse::createFromRedirectResponse()
68     // is itself cacheable.
69     $expected_cacheability = ($redirect_response instanceof CacheableResponseInterface) ? $redirect_response->getCacheableMetadata() : (new CacheableMetadata())->setCacheMaxAge(0);
70     $this->assertEquals($expected_cacheability, $trusted_redirect_response->getCacheableMetadata());
71   }
72
73   /**
74    * @return array
75    */
76   public function providerCreateFromRedirectResponse() {
77     return [
78       'cacheable-with-tags' => [(new CacheableRedirectResponse('/example'))->addCacheableDependency((new CacheableMetadata())->addCacheTags(['foo']))],
79       'cacheable-with-max-age-0' => [(new CacheableRedirectResponse('/example'))->addCacheableDependency((new CacheableMetadata())->setCacheMaxAge(0))],
80       'uncacheable' => [new RedirectResponse('/example')],
81     ];
82   }
83
84 }