diff --git a/tests/Feature/AdminPlatformOrderShowBackLinkTest.php b/tests/Feature/AdminPlatformOrderShowBackLinkTest.php index 9078128..3222d76 100644 --- a/tests/Feature/AdminPlatformOrderShowBackLinkTest.php +++ b/tests/Feature/AdminPlatformOrderShowBackLinkTest.php @@ -98,5 +98,10 @@ class AdminPlatformOrderShowBackLinkTest extends TestCase $this->get('/admin/platform-orders/' . $order->id . '?back=https://evil.example.com') ->assertOk() ->assertDontSee('返回上一页(保留上下文)'); + + // 协议相对 URL 也应被拒绝 + $this->get('/admin/platform-orders/' . $order->id . '?back=' . urlencode('//evil.example.com/a')) + ->assertOk() + ->assertDontSee('返回上一页(保留上下文)'); } }