linxianzhuang/saasshop
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Test: add unit coverage for BackUrl::sanitizeForLinks

Browse Source
This commit is contained in:
萝卜
2026-03-15 01:33:04 +00:00
parent c5e0226da2
commit d916c6a4b3
1 changed files with 42 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
tests/Unit/BackUrlSanitizeForLinksTest.php Normal file
View File

@@ -0,0 +1,42 @@
<?php
namespace Tests\Unit;
use App\Support\BackUrl;
use PHPUnit\Framework\TestCase;
class BackUrlSanitizeForLinksTest extends TestCase
{
public function test_sanitize_for_links_should_accept_simple_relative_path(): void
{
$this->assertSame('/admin/platform-orders', BackUrl::sanitizeForLinks('/admin/platform-orders'));
}
public function test_sanitize_for_links_should_reject_absolute_urls(): void
{
$this->assertSame('', BackUrl::sanitizeForLinks('https://evil.com/a'));
$this->assertSame('', BackUrl::sanitizeForLinks('http://evil.com/a'));
}
public function test_sanitize_for_links_should_reject_quotes_and_angle_brackets(): void
{
$this->assertSame('', BackUrl::sanitizeForLinks('/admin/x?keyword="a"'));
$this->assertSame('', BackUrl::sanitizeForLinks("/admin/x?keyword='a'"));
$this->assertSame('', BackUrl::sanitizeForLinks('/admin/x?a=<b>'));
$this->assertSame('', BackUrl::sanitizeForLinks('/admin/x?a=>'));
}
public function test_sanitize_for_links_should_reject_nested_back_param(): void
{
$this->assertSame('', BackUrl::sanitizeForLinks('/admin/x?back=/admin/y'));
$this->assertSame('', BackUrl::sanitizeForLinks('/admin/x?a=1&back=/admin/y'));
$this->assertSame('', BackUrl::sanitizeForLinks('/admin/x?a=1&b=2&back=/admin/y'));
}
public function test_sanitize_for_links_should_reject_paths_not_starting_with_slash(): void
{
$this->assertSame('', BackUrl::sanitizeForLinks('admin/platform-orders'));
$this->assertSame('', BackUrl::sanitizeForLinks('../admin/platform-orders'));
$this->assertSame('', BackUrl::sanitizeForLinks('javascript:alert(1)'));
}
}