From 722f4a1f44a8294ea9ea870337566e79017c77de Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=90=9D=E5=8D=9C?= Date: Sat, 14 Mar 2026 10:41:48 +0000 Subject: [PATCH] Harden products batch return_url: reject quotes and nested back --- .../Controllers/Admin/ProductController.php | 18 ++++- .../MerchantAdmin/ProductController.php | 18 ++++- ...dminProductsBatchReturnUrlSanitizeTest.php | 70 +++++++++++++++++++ ...hantProductsBatchReturnUrlSanitizeTest.php | 69 ++++++++++++++++++ 4 files changed, 173 insertions(+), 2 deletions(-) create mode 100644 tests/Feature/AdminProductsBatchReturnUrlSanitizeTest.php create mode 100644 tests/Feature/MerchantProductsBatchReturnUrlSanitizeTest.php diff --git a/app/Http/Controllers/Admin/ProductController.php b/app/Http/Controllers/Admin/ProductController.php index 522f9c3..eaba9c5 100644 --- a/app/Http/Controllers/Admin/ProductController.php +++ b/app/Http/Controllers/Admin/ProductController.php @@ -649,7 +649,23 @@ class ProductController extends Controller return $default; } - return str_starts_with($candidate, '/admin/products') ? $candidate : $default; + // 作为“批量操作返回地址”，只允许站内相对路径，并且需要稳定可控： + // - 限定前缀（避免跳出 admin/products 语义域） + // - 拒绝引号/尖括号（降低注入风险） + // - 拒绝 nested back=（避免 URL 膨胀/绕过） + if (! str_starts_with($candidate, '/admin/products')) { + return $default; + } + + if (preg_match('/["\'<>]/', $candidate)) { + return $default; + } + + if (preg_match('/(?:^|[?&])back=/', $candidate)) { + return $default; + } + + return $candidate; } protected function filters(Request $request): array diff --git a/app/Http/Controllers/MerchantAdmin/ProductController.php b/app/Http/Controllers/MerchantAdmin/ProductController.php index c1cf150..617189e 100644 --- a/app/Http/Controllers/MerchantAdmin/ProductController.php +++ b/app/Http/Controllers/MerchantAdmin/ProductController.php @@ -621,7 +621,23 @@ class ProductController extends Controller return $default; } - return str_starts_with($candidate, '/merchant-admin/products') ? $candidate : $default; + // 作为“批量操作返回地址”，只允许站内相对路径，并且需要稳定可控： + // - 限定前缀（避免跳出 merchant-admin/products 语义域） + // - 拒绝引号/尖括号（降低注入风险） + // - 拒绝 nested back=（避免 URL 膨胀/绕过） + if (! str_starts_with($candidate, '/merchant-admin/products')) { + return $default; + } + + if (preg_match('/["\'<>]/', $candidate)) { + return $default; + } + + if (preg_match('/(?:^|[?&])back=/', $candidate)) { + return $default; + } + + return $candidate; } protected function filters(Request $request): array diff --git a/tests/Feature/AdminProductsBatchReturnUrlSanitizeTest.php b/tests/Feature/AdminProductsBatchReturnUrlSanitizeTest.php new file mode 100644 index 0000000..91b3669 --- /dev/null +++ b/tests/Feature/AdminProductsBatchReturnUrlSanitizeTest.php @@ -0,0 +1,70 @@ +seed(); + + $this->post('/admin/login', [ + 'email' => 'platform.admin@demo.local', + 'password' => 'Platform@123456', + ])->assertRedirect('/admin'); + } + + public function test_admin_products_batch_redirects_to_default_when_return_url_has_nested_back(): void + { + $this->loginAsPlatformAdmin(); + + $product = \App\Models\Product::query()->orderBy('id')->firstOrFail(); + + $response = $this->post('/admin/products/batch', [ + 'product_ids' => [$product->id], + 'action' => 'change_status', + 'status' => 'offline', + // nested back= should be rejected + 'return_url' => '/admin/products?status=published&back=/admin', + ]); + + $response->assertRedirect('/admin/products'); + } + + public function test_admin_products_batch_redirects_to_default_when_return_url_contains_quotes(): void + { + $this->loginAsPlatformAdmin(); + + $product = \App\Models\Product::query()->orderBy('id')->firstOrFail(); + + $response = $this->post('/admin/products/batch', [ + 'product_ids' => [$product->id], + 'action' => 'change_status', + 'status' => 'offline', + 'return_url' => '/admin/products?status=published"', + ]); + + $response->assertRedirect('/admin/products'); + } + + public function test_admin_products_batch_keeps_return_url_when_safe(): void + { + $this->loginAsPlatformAdmin(); + + $product = \App\Models\Product::query()->orderBy('id')->firstOrFail(); + + $response = $this->post('/admin/products/batch', [ + 'product_ids' => [$product->id], + 'action' => 'change_status', + 'status' => 'offline', + 'return_url' => '/admin/products?status=published&merchant_id=1', + ]); + + $response->assertRedirect('/admin/products?status=published&merchant_id=1'); + } +} diff --git a/tests/Feature/MerchantProductsBatchReturnUrlSanitizeTest.php b/tests/Feature/MerchantProductsBatchReturnUrlSanitizeTest.php new file mode 100644 index 0000000..4531986 --- /dev/null +++ b/tests/Feature/MerchantProductsBatchReturnUrlSanitizeTest.php @@ -0,0 +1,69 @@ +seed(); + + $this->post('/merchant-admin/login', [ + 'email' => 'merchant.admin@demo.local', + 'password' => 'Merchant@123456', + ])->assertRedirect('/merchant-admin'); + } + + public function test_merchant_products_batch_redirects_to_default_when_return_url_has_nested_back(): void + { + $this->loginAsMerchantAdmin(); + + $product = \App\Models\Product::query()->where('merchant_id', 1)->orderBy('id')->firstOrFail(); + + $response = $this->post('/merchant-admin/products/batch', [ + 'product_ids' => [$product->id], + 'action' => 'change_status', + 'status' => 'offline', + 'return_url' => '/merchant-admin/products?status=published&back=/merchant-admin', + ]); + + $response->assertRedirect('/merchant-admin/products'); + } + + public function test_merchant_products_batch_redirects_to_default_when_return_url_contains_quotes(): void + { + $this->loginAsMerchantAdmin(); + + $product = \App\Models\Product::query()->where('merchant_id', 1)->orderBy('id')->firstOrFail(); + + $response = $this->post('/merchant-admin/products/batch', [ + 'product_ids' => [$product->id], + 'action' => 'change_status', + 'status' => 'offline', + 'return_url' => '/merchant-admin/products?status=published\'', + ]); + + $response->assertRedirect('/merchant-admin/products'); + } + + public function test_merchant_products_batch_keeps_return_url_when_safe(): void + { + $this->loginAsMerchantAdmin(); + + $product = \App\Models\Product::query()->where('merchant_id', 1)->orderBy('id')->firstOrFail(); + + $response = $this->post('/merchant-admin/products/batch', [ + 'product_ids' => [$product->id], + 'action' => 'change_status', + 'status' => 'offline', + 'return_url' => '/merchant-admin/products?status=published&keyword=SKU', + ]); + + $response->assertRedirect('/merchant-admin/products?status=published&keyword=SKU'); + } +}