function JsonApiRelationshipTest::testMultiValueRelationshipPostDoesNotAllowObjectInjection

POST to a to-many relationship does not allow object injection.

File

core/modules/jsonapi/tests/src/Functional/JsonApiRelationshipTest.php, line 330

Class

JsonApiRelationshipTest

JSON:API resource tests.

Namespace

Code

public function testMultiValueRelationshipPostDoesNotAllowObjectInjection() : void {
  $this->config('jsonapi.settings')
    ->set('read_only', FALSE)
    ->save();
  $user = $this->drupalCreateUser([
    'view test entity',
    'edit own entity_test content',
  ]);
  $storage = $this->container
    ->get('entity_type.manager')
    ->getStorage($this->entityTypeId);
  $parentEntity = $storage->create([
    'type' => $this->bundle,
    'user_id' => $user->id(),
  ]);
  $parentEntity->save();
  $targetEntity = $storage->create([
    'type' => $this->bundle,
  ]);
  $targetEntity->save();
  $url = Url::fromUri(sprintf('internal:/jsonapi/%s/%s/%s/relationships/%s', $this->entityTypeId, $this->bundle, $parentEntity->uuid(), $this->fieldNameWithMeta));
  $response = $this->request('POST', $url, [
    RequestOptions::HEADERS => [
      'Content-Type' => 'application/vnd.api+json',
      'Accept' => 'application/vnd.api+json',
    ],
    RequestOptions::AUTH => [
      $user->getAccountName(),
      $user->pass_raw,
    ],
    RequestOptions::JSON => [
      'data' => [
        [
          'id' => $targetEntity->uuid(),
          'type' => sprintf('%s--%s', $this->entityTypeId, $this->bundle),
          'meta' => [
            'data' => serialize(new TestGadget()),
          ],
        ],
      ],
    ],
  ]);
  $this->assertStringNotContainsString('JSONAPI_TEST_GADGET_WAKEUP_CALLED', (string) $response->getBody(), 'Object injection succeeded: TestGadget::__wakeup() was called.');
}