@ -10,6 +10,7 @@ declare(strict_types=1);
namespace OCA\DAV\Tests\unit\Connector\Sabre ;
use OCA\DAV\Connector\Sabre\BlockLegacyClientPlugin ;
use OCA\Theming\ThemingDefaults ;
use OCP\IConfig ;
use PHPUnit\Framework\MockObject\MockObject ;
use Sabre\HTTP\RequestInterface ;
@ -21,19 +22,23 @@ use Test\TestCase;
* @ package OCA\DAV\Tests\unit\Connector\Sabre
*/
class BlockLegacyClientPluginTest extends TestCase {
/** @var IConfig|MockObject */
private $config ;
/** @var BlockLegacyClientPlugin */
private $blockLegacyClientVersionPlugin ;
private IConfig & MockObject $config ;
private ThemingDefaults & MockObject $themingDefaults ;
private BlockLegacyClientPlugin $blockLegacyClientVersionPlugin ;
protected function setUp () : void {
parent :: setUp ();
$this -> config = $this -> createMock ( IConfig :: class );
$this -> blockLegacyClientVersionPlugin = new BlockLegacyClientPlugin ( $this -> config );
$this -> themingDefaults = $this -> createMock ( ThemingDefaults :: class );
$this -> blockLegacyClientVersionPlugin = new BlockLegacyClientPlugin (
$this -> config ,
$this -> themingDefaults ,
);
}
public function oldDesktopClientProvider () : array {
public static function oldDesktopClientProvider () : array {
return [
[ 'Mozilla/5.0 (Windows) mirall/1.5.0' ],
[ 'Mozilla/5.0 (Bogus Text) mirall/1.6.9' ],
@ -45,7 +50,19 @@ class BlockLegacyClientPluginTest extends TestCase {
*/
public function testBeforeHandlerException ( string $userAgent ) : void {
$this -> expectException ( \Sabre\DAV\Exception\Forbidden :: class );
$this -> expectExceptionMessage ( 'Unsupported client version.' );
$this -> themingDefaults
-> expects ( $this -> once ())
-> method ( 'getSyncClientUrl' )
-> willReturn ( 'https://nextcloud.com/install/#install-clients' );
$this -> config
-> expects ( $this -> once ())
-> method ( 'getSystemValue' )
-> with ( 'minimum.supported.desktop.version' , '2.3.0' )
-> willReturn ( '1.7.0' );
$this -> expectExceptionMessage ( 'This version of the client is unsupported. Upgrade to <a href="https://nextcloud.com/install/#install-clients">version 1.7.0 or later</a>.' );
/** @var RequestInterface|MockObject $request */
$request = $this -> createMock ( '\Sabre\HTTP\RequestInterface' );
@ -55,11 +72,38 @@ class BlockLegacyClientPluginTest extends TestCase {
-> with ( 'User-Agent' )
-> willReturn ( $userAgent );
$this -> blockLegacyClientVersionPlugin -> beforeHandler ( $request );
}
/**
* Ensure that there is no room for XSS attack through configured URL / version
* @ dataProvider oldDesktopClientProvider
*/
public function testBeforeHandlerExceptionPreventXSSAttack ( string $userAgent ) : void {
$this -> expectException ( \Sabre\DAV\Exception\Forbidden :: class );
$this -> themingDefaults
-> expects ( $this -> once ())
-> method ( 'getSyncClientUrl' )
-> willReturn ( 'https://example.com"><script>alter("hacked");</script>' );
$this -> config
-> expects ( $this -> once ())
-> method ( 'getSystemValue' )
-> with ( 'minimum.supported.desktop.version' , '2.3.0' )
-> willReturn ( '1.7.0' );
-> willReturn ( '1.7.0 <script>alert("unsafe")</script>' );
$this -> expectExceptionMessage ( 'This version of the client is unsupported. Upgrade to <a href="https://example.com"><script>alter("hacked");</script>">version 1.7.0 <script>alert("unsafe")</script> or later</a>.' );
/** @var RequestInterface|MockObject $request */
$request = $this -> createMock ( '\Sabre\HTTP\RequestInterface' );
$request
-> expects ( $this -> once ())
-> method ( 'getHeader' )
-> with ( 'User-Agent' )
-> willReturn ( $userAgent );
$this -> blockLegacyClientVersionPlugin -> beforeHandler ( $request );
}
Ferdinand Thiessen
1 year ago
GitHub