BackUrl::sanitizeForLinks 增加长度安全阀（>2000 拒绝）并补单测

2026-03-15 04:45:04 +00:00
parent c4c91ebf14
commit d34578452c
2 changed files with 12 additions and 0 deletions
--- a/tests/Unit/BackUrlSanitizeForLinksTest.php
+++ b/tests/Unit/BackUrlSanitizeForLinksTest.php
@@ -12,6 +12,12 @@ class BackUrlSanitizeForLinksTest extends TestCase
        $this->assertSame('/admin/platform-orders', BackUrl::sanitizeForLinks('/admin/platform-orders'));
    }

+    public function test_sanitize_for_links_should_reject_too_long_back(): void
+    {
+        $long = '/admin/x?' . str_repeat('a', 5000);
+        $this->assertSame('', BackUrl::sanitizeForLinks($long));
+    }
+
    public function test_sanitize_for_links_should_reject_absolute_urls(): void
    {
        $this->assertSame('', BackUrl::sanitizeForLinks('https://evil.com/a'));