linxianzhuang/saasshop
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(back): index 页 back 链接不应 escape &（护栏）

Browse Source
This commit is contained in:
萝卜
2026-03-14 01:21:21 +00:00
parent 4116ea5f9f
commit ca5e8e63e4
3 changed files with 109 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
tests/Feature/AdminPlanIndexBackLinkNotEscapedTest.php Normal file
View File

@@ -0,0 +1,33 @@
<?php
namespace Tests\Feature;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
class AdminPlanIndexBackLinkNotEscapedTest extends TestCase
{
use RefreshDatabase;
protected function loginAsPlatformAdmin(): void
{
$this->seed();
$this->post('/admin/login', [
'email' => 'platform.admin@demo.local',
'password' => 'Platform@123456',
])->assertRedirect('/admin');
}
public function test_index_back_link_should_not_escape_ampersand(): void
{
$this->loginAsPlatformAdmin();
$back = '/admin/site-subscriptions?status=activated&keyword=test';
$this->get('/admin/plans?back=' . urlencode($back))
->assertOk()
->assertSee('返回上一页（保留上下文）')
->assertSee('href="' . $back . '"', false);
}
}

43
tests/Feature/AdminPlatformOrderIndexBackLinkNotEscapedTest.php Normal file
View File

@@ -0,0 +1,43 @@
<?php
namespace Tests\Feature;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
class AdminPlatformOrderIndexBackLinkNotEscapedTest extends TestCase
{
use RefreshDatabase;
protected function loginAsPlatformAdmin(): void
{
$this->seed();
$this->post('/admin/login', [
'email' => 'platform.admin@demo.local',
'password' => 'Platform@123456',
])->assertRedirect('/admin');
}
public function test_index_back_link_should_not_escape_ampersand(): void
{
$this->loginAsPlatformAdmin();
$back = '/admin/site-subscriptions?status=activated&keyword=test';
$this->get('/admin/platform-orders?back=' . urlencode($back))
->assertOk()
->assertSee('返回上一页（保留上下文）')
// 关键护栏：必须是原样 &，不能被 escape 成 &amp;
->assertSee('href="' . $back . '"', false);
}
public function test_index_should_not_show_back_link_when_back_is_external_url(): void
{
$this->loginAsPlatformAdmin();
$this->get('/admin/platform-orders?back=' . urlencode('https://evil.example.com/?x=1&y=2'))
->assertOk()
->assertDontSee('返回上一页（保留上下文）');
}
}

33
tests/Feature/AdminSiteSubscriptionIndexBackLinkNotEscapedTest.php Normal file
View File

@@ -0,0 +1,33 @@
<?php
namespace Tests\Feature;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
class AdminSiteSubscriptionIndexBackLinkNotEscapedTest extends TestCase
{
use RefreshDatabase;
protected function loginAsPlatformAdmin(): void
{
$this->seed();
$this->post('/admin/login', [
'email' => 'platform.admin@demo.local',
'password' => 'Platform@123456',
])->assertRedirect('/admin');
}
public function test_index_back_link_should_not_escape_ampersand(): void
{
$this->loginAsPlatformAdmin();
$back = '/admin/platform-orders?status=pending&keyword=test';
$this->get('/admin/site-subscriptions?back=' . urlencode($back))
->assertOk()
->assertSee('返回上一页（保留上下文）')
->assertSee('href="' . $back . '"', false);
}
}