Twyco
ce36060ba1
CI/CD / preconditions (pull_request) Successful in 2s
Native JavaScript checks / Native launcher and release tests (pull_request) Successful in 1m7s
CI/CD / test_and_check_app (pull_request) Successful in 6m26s
CI/CD / Publish immutable image (pull_request) Skipped
macOS checks / Native Rust tests and unsigned build (pull_request) Canceled after 0s
40 lines
1.1 KiB
PHP
40 lines
1.1 KiB
PHP
<?php
|
|
|
|
namespace Tests\Unit;
|
|
|
|
use League\Flysystem\CorruptedPathDetected;
|
|
use League\Flysystem\WhitespacePathNormalizer;
|
|
use PHPUnit\Framework\Attributes\DataProvider;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
class FilesystemPathSecurityTest extends TestCase
|
|
{
|
|
#[DataProvider('corruptedPaths')]
|
|
public function test_corrupted_paths_are_rejected(string $path): void
|
|
{
|
|
$this->expectException(CorruptedPathDetected::class);
|
|
|
|
(new WhitespacePathNormalizer)->normalizePath($path);
|
|
}
|
|
|
|
/**
|
|
* @return array<string, array{string}>
|
|
*/
|
|
public static function corruptedPaths(): array
|
|
{
|
|
return [
|
|
'control character' => ["avatars/user\x00.svg"],
|
|
'malformed UTF-8' => ["avatars/user\xFF.svg"],
|
|
'control character hidden by malformed UTF-8' => ["avatars/user\xFF\x00.svg"],
|
|
];
|
|
}
|
|
|
|
public function test_valid_unicode_paths_remain_supported(): void
|
|
{
|
|
$this->assertSame(
|
|
'avatars/benützer.svg',
|
|
(new WhitespacePathNormalizer)->normalizePath('./avatars//benützer.svg'),
|
|
);
|
|
}
|
|
}
|