-
-
Notifications
You must be signed in to change notification settings - Fork 18
Expand file tree
/
Copy pathRequestTest.php
More file actions
58 lines (48 loc) · 1.69 KB
/
Copy pathRequestTest.php
File metadata and controls
58 lines (48 loc) · 1.69 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
<?php
namespace Bow\Tests\Http;
use Bow\Http\Request;
use PHPUnit\Framework\TestCase;
class RequestTest extends TestCase
{
protected function setUp(): void
{
$_GET = [];
$_POST = [];
$_SERVER['REQUEST_METHOD'] = 'POST';
unset($_SERVER['CONTENT_TYPE'], $_SERVER['HTTP_CONTENT_TYPE']);
}
/**
* Input is data, never code: is_callable() is true for the name of any
* defined function, so resolving it would let a client call `phpinfo` (or
* any other zero-argument function) simply by submitting its name, and
* would hand the caller that function's return value instead of the string
* it asked for.
*
* @dataProvider callableLookingInput
*/
public function testInputNamingAFunctionIsNotInvoked(string $value): void
{
$this->assertTrue(is_callable($value), "fixture {$value} must be a real function");
$_POST = ['field' => $value];
$request = new Request();
$request->capture();
$this->assertSame($value, $request->get('field'));
}
/** A callable default is the feature this guard must preserve. */
public function testCallableDefaultIsStillResolved(): void
{
$request = new Request();
$request->capture();
$this->assertSame('resolved', $request->get('absent', fn () => 'resolved'));
$this->assertSame('plain', $request->get('absent', 'plain'));
}
/** @return array<string, array{0: string}> */
public static function callableLookingInput(): array
{
return [
'php builtin' => ['phpinfo'],
'string function' => ['trim'],
'array function' => ['compact'],
];
}
}