48 lines
1.4 KiB
PHP
48 lines
1.4 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature;
|
|
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use PHPUnit\Framework\Attributes\DataProvider;
|
|
use Tests\TestCase;
|
|
|
|
class AdminPlanIndexUnsafeBackShouldBeDroppedForLinksTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
protected function loginAsPlatformAdmin(): void
|
|
{
|
|
$this->seed();
|
|
|
|
$this->post('/admin/login', [
|
|
'email' => 'platform.admin@demo.local',
|
|
'password' => 'Platform@123456',
|
|
])->assertRedirect('/admin');
|
|
}
|
|
|
|
public static function invalidBackProvider(): array
|
|
{
|
|
return [
|
|
'contains quote' => ['/' . 'admin/plans?x="y"'],
|
|
'contains angle bracket' => ['/admin/plans?x=<script>'],
|
|
'nested back param' => ['/admin/plans?status=active&back=/admin/platform-orders'],
|
|
'absolute url' => ['https://evil.example.com'],
|
|
];
|
|
}
|
|
|
|
#[DataProvider('invalidBackProvider')]
|
|
public function test_index_should_drop_unsafe_back_for_links(string $back): void
|
|
{
|
|
$this->loginAsPlatformAdmin();
|
|
|
|
$res = $this->get('/admin/plans?back=' . urlencode($back));
|
|
$res->assertOk();
|
|
|
|
// 不应渲染 back 回退入口
|
|
$res->assertDontSee('返回上一页（保留上下文）');
|
|
|
|
// 快捷筛选链接不应透传 unsafe back
|
|
$res->assertDontSee('back=' . $back, false);
|
|
}
|
|
}
|