request_sanitizer.test

<?php


/**
 * @file
 * Tests for the RequestSanitizer class.
 */

/**
 * Tests DrupalRequestSanitizer class.
 */
class RequestSanitizerTest extends DrupalUnitTestCase {
    
    /**
     * Log of errors triggered during sanitization.
     *
     * @var array
     */
    protected $errors;
    
    /**
     * {@inheritdoc}
     */
    public static function getInfo() {
        return array(
            'name' => 'DrupalRequestSanitizer',
            'description' => 'Test the DrupalRequestSanitizer class',
            'group' => 'System',
        );
    }
    
    /**
     * {@inheritdoc}
     */
    protected function setUp() {
        require_once DRUPAL_ROOT . '/includes/request-sanitizer.inc';
        parent::setUp();
        set_error_handler(array(
            $this,
            "sanitizerTestErrorHandler",
        ));
    }
    
    /**
     * Iterate through all the RequestSanitizerTests.
     */
    public function testRequestSanitization() {
        foreach ($this->requestSanitizerTests() as $label => $data) {
            $this->errors = array();
            // Normalize the test parameters.
            $test = array(
                'request' => $data[0],
                'expected' => isset($data[1]) ? $data[1] : array(),
                'expected_errors' => isset($data[2]) ? $data[2] : NULL,
                'whitelist' => isset($data[3]) ? $data[3] : array(),
            );
            $this->requestSanitizationTest($test['request'], $test['expected'], $test['expected_errors'], $test['whitelist'], $label);
        }
    }
    
    /**
     * Tests RequestSanitizer class.
     *
     * @param \SanitizerTestRequest $request
     *   The request to sanitize.
     * @param array $expected
     *   An array of expected request parameters after sanitization.
     * @param array|null $expected_errors
     *   An array of expected errors. If set to NULL then error logging is
     *   disabled.
     * @param array $whitelist
     *   An array of keys to whitelist and not sanitize.
     * @param string $label
     *   A descriptive name for each test / group of assertions.
     *
     * @throws \ReflectionException
     */
    public function requestSanitizationTest(SanitizerTestRequest $request, array $expected = array(), array $expected_errors = NULL, array $whitelist = array(), $label = NULL) {
        // Set up globals.
        $_GET = $request->getQuery();
        $_POST = $request->getRequest();
        $_COOKIE = $request->getCookies();
        $_REQUEST = array_merge($request->getQuery(), $request->getRequest());
        $GLOBALS['conf']['sanitize_input_whitelist'] = $whitelist;
        $GLOBALS['conf']['sanitize_input_logging'] = is_null($expected_errors) ? FALSE : TRUE;
        if ($label !== 'already sanitized request') {
            $reflection = new \ReflectionProperty('DrupalRequestSanitizer', 'sanitized');
            $reflection->setAccessible(TRUE);
            $reflection->setValue(NULL, FALSE);
        }
        DrupalRequestSanitizer::sanitize();
        if (isset($_GET['destination'])) {
            DrupalRequestSanitizer::cleanDestination();
        }
        // Normalise the expected data.
        $expected += array(
            'cookies' => array(),
            'query' => array(),
            'request' => array(),
        );
        // Test PHP globals.
        $this->assertEqualLabelled($expected['cookies'], $_COOKIE, NULL, 'Other', $label . ' (COOKIE)');
        $this->assertEqualLabelled($expected['query'], $_GET, NULL, 'Other', $label . ' (GET)');
        $this->assertEqualLabelled($expected['request'], $_POST, NULL, 'Other', $label . ' (POST)');
        $expected_request = array_merge($expected['query'], $expected['request']);
        $this->assertEqualLabelled($expected_request, $_REQUEST, NULL, 'Other', $label . ' (REQUEST)');
        // Ensure any expected errors have been triggered.
        if (!empty($expected_errors)) {
            foreach ($expected_errors as $expected_error) {
                $this->assertError($expected_error, E_USER_NOTICE, $label . ' (errors)');
            }
        }
        else {
            $this->assertEqualLabelled(array(), $this->errors, NULL, 'Other', $label . ' (errors)');
        }
    }
    
    /**
     * Data provider for testRequestSanitization.
     *
     * @return array
     *   A list of tests to carry out.
     */
    public function requestSanitizerTests() {
        $tests = array();
        $request = new SanitizerTestRequest(array(
            'q' => 'index.php',
        ));
        $tests['no sanitization GET'] = array(
            $request,
            array(
                'query' => array(
                    'q' => 'index.php',
                ),
            ),
        );
        $request = new SanitizerTestRequest(array(), array(
            'field' => 'value',
        ));
        $tests['no sanitization POST'] = array(
            $request,
            array(
                'request' => array(
                    'field' => 'value',
                ),
            ),
        );
        $request = new SanitizerTestRequest(array(), array(), array(), array(
            'key' => 'value',
        ));
        $tests['no sanitization COOKIE'] = array(
            $request,
            array(
                'cookies' => array(
                    'key' => 'value',
                ),
            ),
        );
        $request = new SanitizerTestRequest(array(
            'q' => 'index.php',
        ), array(
            'field' => 'value',
        ), array(), array(
            'key' => 'value',
        ));
        $tests['no sanitization GET, POST, COOKIE'] = array(
            $request,
            array(
                'query' => array(
                    'q' => 'index.php',
                ),
                'request' => array(
                    'field' => 'value',
                ),
                'cookies' => array(
                    'key' => 'value',
                ),
            ),
        );
        $request = new SanitizerTestRequest(array(
            'q' => 'index.php',
        ));
        $tests['no sanitization GET log'] = array(
            $request,
            array(
                'query' => array(
                    'q' => 'index.php',
                ),
            ),
            array(),
        );
        $request = new SanitizerTestRequest(array(), array(
            'field' => 'value',
        ));
        $tests['no sanitization POST log'] = array(
            $request,
            array(
                'request' => array(
                    'field' => 'value',
                ),
            ),
            array(),
        );
        $request = new SanitizerTestRequest(array(), array(), array(), array(
            'key' => 'value',
        ));
        $tests['no sanitization COOKIE log'] = array(
            $request,
            array(
                'cookies' => array(
                    'key' => 'value',
                ),
            ),
            array(),
        );
        $request = new SanitizerTestRequest(array(
            '#q' => 'index.php',
        ));
        $tests['sanitization GET'] = array(
            $request,
        );
        $request = new SanitizerTestRequest(array(), array(
            '#field' => 'value',
        ));
        $tests['sanitization POST'] = array(
            $request,
        );
        $request = new SanitizerTestRequest(array(), array(), array(), array(
            '#key' => 'value',
        ));
        $tests['sanitization COOKIE'] = array(
            $request,
        );
        $request = new SanitizerTestRequest(array(
            '#q' => 'index.php',
        ), array(
            '#field' => 'value',
        ), array(), array(
            '#key' => 'value',
        ));
        $tests['sanitization GET, POST, COOKIE'] = array(
            $request,
        );
        $request = new SanitizerTestRequest(array(
            '#q' => 'index.php',
        ));
        $tests['sanitization GET log'] = array(
            $request,
            array(),
            array(
                'Potentially unsafe keys removed from query string parameters (GET): #q',
            ),
        );
        $request = new SanitizerTestRequest(array(), array(
            '#field' => 'value',
        ));
        $tests['sanitization POST log'] = array(
            $request,
            array(),
            array(
                'Potentially unsafe keys removed from request body parameters (POST): #field',
            ),
        );
        $request = new SanitizerTestRequest(array(), array(), array(), array(
            '#key' => 'value',
        ));
        $tests['sanitization COOKIE log'] = array(
            $request,
            array(),
            array(
                'Potentially unsafe keys removed from cookie parameters (COOKIE): #key',
            ),
        );
        $request = new SanitizerTestRequest(array(
            '#q' => 'index.php',
        ), array(
            '#field' => 'value',
        ), array(), array(
            '#key' => 'value',
        ));
        $tests['sanitization GET, POST, COOKIE log'] = array(
            $request,
            array(),
            array(
                'Potentially unsafe keys removed from query string parameters (GET): #q',
                'Potentially unsafe keys removed from request body parameters (POST): #field',
                'Potentially unsafe keys removed from cookie parameters (COOKIE): #key',
            ),
        );
        $request = new SanitizerTestRequest(array(
            'q' => 'index.php',
            'foo' => array(
                '#bar' => 'foo',
            ),
        ));
        $tests['recursive sanitization log'] = array(
            $request,
            array(
                'query' => array(
                    'q' => 'index.php',
                    'foo' => array(),
                ),
            ),
            array(
                'Potentially unsafe keys removed from query string parameters (GET): #bar',
            ),
        );
        $request = new SanitizerTestRequest(array(
            'q' => 'index.php',
            'foo' => array(
                '#bar' => 'foo',
            ),
        ));
        $tests['recursive no sanitization whitelist'] = array(
            $request,
            array(
                'query' => array(
                    'q' => 'index.php',
                    'foo' => array(
                        '#bar' => 'foo',
                    ),
                ),
            ),
            array(),
            array(
                '#bar',
            ),
        );
        $request = new SanitizerTestRequest(array(), array(
            '#field' => 'value',
        ));
        $tests['no sanitization POST whitelist'] = array(
            $request,
            array(
                'request' => array(
                    '#field' => 'value',
                ),
            ),
            array(),
            array(
                '#field',
            ),
        );
        $request = new SanitizerTestRequest(array(
            'q' => 'index.php',
            'foo' => array(
                '#bar' => 'foo',
                '#foo' => 'bar',
            ),
        ));
        $tests['recursive multiple sanitization log'] = array(
            $request,
            array(
                'query' => array(
                    'q' => 'index.php',
                    'foo' => array(),
                ),
            ),
            array(
                'Potentially unsafe keys removed from query string parameters (GET): #bar, #foo',
            ),
        );
        $request = new SanitizerTestRequest(array(
            '#q' => 'index.php',
        ));
        $tests['already sanitized request'] = array(
            $request,
            array(
                'query' => array(
                    '#q' => 'index.php',
                ),
            ),
        );
        $request = new SanitizerTestRequest(array(
            'destination' => 'whatever?%23test=value',
        ));
        $tests['destination removal GET'] = array(
            $request,
        );
        $request = new SanitizerTestRequest(array(
            'destination' => 'whatever?%23test=value',
        ));
        $tests['destination removal GET log'] = array(
            $request,
            array(),
            array(
                'Potentially unsafe destination removed from query string parameters (GET) because it contained the following keys: #test',
            ),
        );
        $request = new SanitizerTestRequest(array(
            'destination' => 'whatever?q[%23test]=value',
        ));
        $tests['destination removal subkey'] = array(
            $request,
        );
        $request = new SanitizerTestRequest(array(
            'destination' => 'whatever?q[%23test]=value',
        ));
        $tests['destination whitelist'] = array(
            $request,
            array(
                'query' => array(
                    'destination' => 'whatever?q[%23test]=value',
                ),
            ),
            array(),
            array(
                '#test',
            ),
        );
        $request = new SanitizerTestRequest(array(
            'destination' => "whatever?\x00bar=base&%23test=value",
        ));
        $tests['destination removal zero byte'] = array(
            $request,
        );
        $request = new SanitizerTestRequest(array(
            'destination' => 'whatever?q=value',
        ));
        $tests['destination kept'] = array(
            $request,
            array(
                'query' => array(
                    'destination' => 'whatever?q=value',
                ),
            ),
        );
        $request = new SanitizerTestRequest(array(
            'destination' => 'whatever',
        ));
        $tests['destination no query'] = array(
            $request,
            array(
                'query' => array(
                    'destination' => 'whatever',
                ),
            ),
        );
        return $tests;
    }
    
    /**
     * Catches and logs errors to $this->errors.
     *
     * @param int $errno
     *   The severity level of the error.
     * @param string $errstr
     *   The error message.
     */
    public function sanitizerTestErrorHandler($errno, $errstr) {
        $this->errors[] = compact('errno', 'errstr');
    }
    
    /**
     * Asserts that the expected error has been logged.
     *
     * @param string $errstr
     *   The error message.
     * @param int $errno
     *   The severity level of the error.
     * @param string $label
     *   The label to include with the message.
     *
     * @return bool
     *   TRUE if the assertion succeeded, FALSE otherwise.
     */
    protected function assertError($errstr, $errno, $label) {
        $label = empty($label) ? '' : $label . ': ';
        foreach ($this->errors as $error) {
            if ($error['errstr'] === $errstr && $error['errno'] === $errno) {
                return $this->pass($label . "Error with level {$errno} and message '{$errstr}' found");
            }
        }
        return $this->fail($label . "Error with level {$errno} and message '{$errstr}' not found in " . var_export($this->errors, TRUE));
    }
    
    /**
     * Asserts two values are equal, includes a label.
     *
     * @param mixed $first
     *   The first value to check.
     * @param mixed $second
     *   The second value to check.
     * @param string $message
     *   The message to display along with the assertion.
     * @param string $group
     *   The type of assertion - examples are "Browser", "PHP".
     * @param string $label
     *   The label to include with the message.
     *
     * @return bool
     *   TRUE if the assertion succeeded, FALSE otherwise.
     */
    protected function assertEqualLabelled($first, $second, $message = '', $group = 'Other', $label = '') {
        $label = empty($label) ? '' : $label . ': ';
        $message = $message ? $message : t('Value @first is equal to value @second.', array(
            '@first' => var_export($first, TRUE),
            '@second' => var_export($second, TRUE),
        ));
        return $this->assert($first == $second, $label . $message, $group);
    }

}

/**
 * Basic HTTP Request class.
 */
class SanitizerTestRequest {
    
    /**
     * The query (GET).
     *
     * @var array
     */
    protected $query;
    
    /**
     * The request (POST).
     *
     * @var array
     */
    protected $request;
    
    /**
     * The request attributes.
     *
     * @var array
     */
    protected $attributes;
    
    /**
     * The request cookies.
     *
     * @var array
     */
    protected $cookies;
    
    /**
     * Constructor.
     *
     * @param array $query
     *   The GET parameters.
     * @param array $request
     *   The POST parameters.
     * @param array $attributes
     *   The request attributes.
     * @param array $cookies
     *   The COOKIE parameters.
     */
    public function __construct(array $query = array(), array $request = array(), array $attributes = array(), array $cookies = array()) {
        $this->query = $query;
        $this->request = $request;
        $this->attributes = $attributes;
        $this->cookies = $cookies;
    }
    
    /**
     * Getter for $query.
     */
    public function getQuery() {
        return $this->query;
    }
    
    /**
     * Getter for $request.
     */
    public function getRequest() {
        return $this->request;
    }
    
    /**
     * Getter for $attributes.
     */
    public function getAttributes() {
        return $this->attributes;
    }
    
    /**
     * Getter for $cookies.
     */
    public function getCookies() {
        return $this->cookies;
    }

}