assertSame('/admin/platform-orders', BackUrl::sanitizeForLinks('/admin/platform-orders')); } public function test_sanitize_for_links_should_reject_absolute_urls(): void { $this->assertSame('', BackUrl::sanitizeForLinks('https://evil.com/a')); $this->assertSame('', BackUrl::sanitizeForLinks('http://evil.com/a')); } public function test_sanitize_for_links_should_reject_quotes_and_angle_brackets(): void { $this->assertSame('', BackUrl::sanitizeForLinks('/admin/x?keyword="a"')); $this->assertSame('', BackUrl::sanitizeForLinks("/admin/x?keyword='a'")); $this->assertSame('', BackUrl::sanitizeForLinks('/admin/x?a=')); $this->assertSame('', BackUrl::sanitizeForLinks('/admin/x?a=>')); } public function test_sanitize_for_links_should_reject_nested_back_param(): void { $this->assertSame('', BackUrl::sanitizeForLinks('/admin/x?back=/admin/y')); $this->assertSame('', BackUrl::sanitizeForLinks('/admin/x?a=1&back=/admin/y')); $this->assertSame('', BackUrl::sanitizeForLinks('/admin/x?a=1&b=2&back=/admin/y')); } public function test_sanitize_for_links_should_reject_paths_not_starting_with_slash(): void { $this->assertSame('', BackUrl::sanitizeForLinks('admin/platform-orders')); $this->assertSame('', BackUrl::sanitizeForLinks('../admin/platform-orders')); $this->assertSame('', BackUrl::sanitizeForLinks('javascript:alert(1)')); } }