Actualización

vendor/symfony/form/Tests/Extension/Csrf/EventListener/CsrfValidationListenerTest.php

@@ -0,0 +1,97 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Form\Tests\Extension\Csrf\EventListener;
+
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Form\FormBuilder;
+use Symfony\Component\Form\FormEvent;
+use Symfony\Component\Form\Extension\Csrf\EventListener\CsrfValidationListener;
+
+class CsrfValidationListenerTest extends TestCase
+{
+    protected $dispatcher;
+    protected $factory;
+    protected $tokenManager;
+    protected $form;
+
+    protected function setUp()
+    {
+        $this->dispatcher = $this->getMockBuilder('Symfony\Component\EventDispatcher\EventDispatcherInterface')->getMock();
+        $this->factory = $this->getMockBuilder('Symfony\Component\Form\FormFactoryInterface')->getMock();
+        $this->tokenManager = $this->getMockBuilder('Symfony\Component\Security\Csrf\CsrfTokenManagerInterface')->getMock();
+        $this->form = $this->getBuilder('post')
+            ->setDataMapper($this->getDataMapper())
+            ->getForm();
+    }
+
+    protected function tearDown()
+    {
+        $this->dispatcher = null;
+        $this->factory = null;
+        $this->tokenManager = null;
+        $this->form = null;
+    }
+
+    protected function getBuilder($name = 'name')
+    {
+        return new FormBuilder($name, null, $this->dispatcher, $this->factory, array('compound' => true));
+    }
+
+    protected function getForm($name = 'name')
+    {
+        return $this->getBuilder($name)->getForm();
+    }
+
+    protected function getDataMapper()
+    {
+        return $this->getMockBuilder('Symfony\Component\Form\DataMapperInterface')->getMock();
+    }
+
+    protected function getMockForm()
+    {
+        return $this->getMockBuilder('Symfony\Component\Form\Test\FormInterface')->getMock();
+    }
+
+    // https://github.com/symfony/symfony/pull/5838
+    public function testStringFormData()
+    {
+        $data = 'XP4HUzmHPi';
+        $event = new FormEvent($this->form, $data);
+
+        $validation = new CsrfValidationListener('csrf', $this->tokenManager, 'unknown', 'Invalid.');
+        $validation->preSubmit($event);
+
+        // Validate accordingly
+        $this->assertSame($data, $event->getData());
+    }
+
+    public function testMaxPostSizeExceeded()
+    {
+        $serverParams = $this
+            ->getMockBuilder('\Symfony\Component\Form\Util\ServerParams')
+            ->disableOriginalConstructor()
+            ->getMock()
+        ;
+
+        $serverParams
+            ->expects($this->once())
+            ->method('hasPostMaxSizeBeenExceeded')
+            ->willReturn(true)
+        ;
+
+        $event = new FormEvent($this->form, array('csrf' => 'token'));
+        $validation = new CsrfValidationListener('csrf', $this->tokenManager, 'unknown', 'Error message', null, null, $serverParams);
+
+        $validation->preSubmit($event);
+        $this->assertEmpty($this->form->getErrors());
+    }
+}

vendor/symfony/form/Tests/Extension/Csrf/Type/FormTypeCsrfExtensionTest.php

@@ -0,0 +1,397 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Form\Tests\Extension\Csrf\Type;
+
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\Form\FormError;
+use Symfony\Component\Form\Test\TypeTestCase;
+use Symfony\Component\Form\Extension\Csrf\CsrfExtension;
+use Symfony\Component\Security\Csrf\CsrfToken;
+
+class FormTypeCsrfExtensionTest_ChildType extends AbstractType
+{
+    public function buildForm(FormBuilderInterface $builder, array $options)
+    {
+        // The form needs a child in order to trigger CSRF protection by
+        // default
+        $builder->add('name', 'Symfony\Component\Form\Extension\Core\Type\TextType');
+    }
+}
+
+class FormTypeCsrfExtensionTest extends TypeTestCase
+{
+    /**
+     * @var \PHPUnit_Framework_MockObject_MockObject
+     */
+    protected $tokenManager;
+
+    /**
+     * @var \PHPUnit_Framework_MockObject_MockObject
+     */
+    protected $translator;
+
+    protected function setUp()
+    {
+        $this->tokenManager = $this->getMockBuilder('Symfony\Component\Security\Csrf\CsrfTokenManagerInterface')->getMock();
+        $this->translator = $this->getMockBuilder('Symfony\Component\Translation\TranslatorInterface')->getMock();
+
+        parent::setUp();
+    }
+
+    protected function tearDown()
+    {
+        $this->tokenManager = null;
+        $this->translator = null;
+
+        parent::tearDown();
+    }
+
+    protected function getExtensions()
+    {
+        return array_merge(parent::getExtensions(), array(
+            new CsrfExtension($this->tokenManager, $this->translator),
+        ));
+    }
+
+    public function testCsrfProtectionByDefaultIfRootAndCompound()
+    {
+        $view = $this->factory
+            ->create('Symfony\Component\Form\Extension\Core\Type\FormType', null, array(
+                'csrf_field_name' => 'csrf',
+                'compound' => true,
+            ))
+            ->createView();
+
+        $this->assertTrue(isset($view['csrf']));
+    }
+
+    public function testNoCsrfProtectionByDefaultIfCompoundButNotRoot()
+    {
+        $view = $this->factory
+            ->createNamedBuilder('root', 'Symfony\Component\Form\Extension\Core\Type\FormType')
+            ->add($this->factory
+                ->createNamedBuilder('form', 'Symfony\Component\Form\Extension\Core\Type\FormType', null, array(
+                    'csrf_field_name' => 'csrf',
+                    'compound' => true,
+                ))
+            )
+            ->getForm()
+            ->get('form')
+            ->createView();
+
+        $this->assertFalse(isset($view['csrf']));
+    }
+
+    public function testNoCsrfProtectionByDefaultIfRootButNotCompound()
+    {
+        $view = $this->factory
+            ->create('Symfony\Component\Form\Extension\Core\Type\FormType', null, array(
+                'csrf_field_name' => 'csrf',
+                'compound' => false,
+            ))
+            ->createView();
+
+        $this->assertFalse(isset($view['csrf']));
+    }
+
+    public function testCsrfProtectionCanBeDisabled()
+    {
+        $view = $this->factory
+            ->create('Symfony\Component\Form\Extension\Core\Type\FormType', null, array(
+                'csrf_field_name' => 'csrf',
+                'csrf_protection' => false,
+                'compound' => true,
+            ))
+            ->createView();
+
+        $this->assertFalse(isset($view['csrf']));
+    }
+
+    public function testGenerateCsrfToken()
+    {
+        $this->tokenManager->expects($this->once())
+            ->method('getToken')
+            ->with('TOKEN_ID')
+            ->will($this->returnValue(new CsrfToken('TOKEN_ID', 'token')));
+
+        $view = $this->factory
+            ->create('Symfony\Component\Form\Extension\Core\Type\FormType', null, array(
+                'csrf_field_name' => 'csrf',
+                'csrf_token_manager' => $this->tokenManager,
+                'csrf_token_id' => 'TOKEN_ID',
+                'compound' => true,
+            ))
+            ->createView();
+
+        $this->assertEquals('token', $view['csrf']->vars['value']);
+    }
+
+    public function testGenerateCsrfTokenUsesFormNameAsIntentionByDefault()
+    {
+        $this->tokenManager->expects($this->once())
+            ->method('getToken')
+            ->with('FORM_NAME')
+            ->will($this->returnValue('token'));
+
+        $view = $this->factory
+            ->createNamed('FORM_NAME', 'Symfony\Component\Form\Extension\Core\Type\FormType', null, array(
+                'csrf_field_name' => 'csrf',
+                'csrf_token_manager' => $this->tokenManager,
+                'compound' => true,
+            ))
+            ->createView();
+
+        $this->assertEquals('token', $view['csrf']->vars['value']);
+    }
+
+    public function testGenerateCsrfTokenUsesTypeClassAsIntentionIfEmptyFormName()
+    {
+        $this->tokenManager->expects($this->once())
+            ->method('getToken')
+            ->with('Symfony\Component\Form\Extension\Core\Type\FormType')
+            ->will($this->returnValue('token'));
+
+        $view = $this->factory
+            ->createNamed('', 'Symfony\Component\Form\Extension\Core\Type\FormType', null, array(
+                'csrf_field_name' => 'csrf',
+                'csrf_token_manager' => $this->tokenManager,
+                'compound' => true,
+            ))
+            ->createView();
+
+        $this->assertEquals('token', $view['csrf']->vars['value']);
+    }
+
+    public function provideBoolean()
+    {
+        return array(
+            array(true),
+            array(false),
+        );
+    }
+
+    /**
+     * @dataProvider provideBoolean
+     */
+    public function testValidateTokenOnSubmitIfRootAndCompound($valid)
+    {
+        $this->tokenManager->expects($this->once())
+            ->method('isTokenValid')
+            ->with(new CsrfToken('TOKEN_ID', 'token'))
+            ->will($this->returnValue($valid));
+
+        $form = $this->factory
+            ->createBuilder('Symfony\Component\Form\Extension\Core\Type\FormType', null, array(
+                'csrf_field_name' => 'csrf',
+                'csrf_token_manager' => $this->tokenManager,
+                'csrf_token_id' => 'TOKEN_ID',
+                'compound' => true,
+            ))
+            ->add('child', 'Symfony\Component\Form\Extension\Core\Type\TextType')
+            ->getForm();
+
+        $form->submit(array(
+            'child' => 'foobar',
+            'csrf' => 'token',
+        ));
+
+        // Remove token from data
+        $this->assertSame(array('child' => 'foobar'), $form->getData());
+
+        // Validate accordingly
+        $this->assertSame($valid, $form->isValid());
+    }
+
+    /**
+     * @dataProvider provideBoolean
+     */
+    public function testValidateTokenOnSubmitIfRootAndCompoundUsesFormNameAsIntentionByDefault($valid)
+    {
+        $this->tokenManager->expects($this->once())
+            ->method('isTokenValid')
+            ->with(new CsrfToken('FORM_NAME', 'token'))
+            ->will($this->returnValue($valid));
+
+        $form = $this->factory
+            ->createNamedBuilder('FORM_NAME', 'Symfony\Component\Form\Extension\Core\Type\FormType', null, array(
+                'csrf_field_name' => 'csrf',
+                'csrf_token_manager' => $this->tokenManager,
+                'compound' => true,
+            ))
+            ->add('child', 'Symfony\Component\Form\Extension\Core\Type\TextType')
+            ->getForm();
+
+        $form->submit(array(
+            'child' => 'foobar',
+            'csrf' => 'token',
+        ));
+
+        // Remove token from data
+        $this->assertSame(array('child' => 'foobar'), $form->getData());
+
+        // Validate accordingly
+        $this->assertSame($valid, $form->isValid());
+    }
+
+    /**
+     * @dataProvider provideBoolean
+     */
+    public function testValidateTokenOnSubmitIfRootAndCompoundUsesTypeClassAsIntentionIfEmptyFormName($valid)
+    {
+        $this->tokenManager->expects($this->once())
+            ->method('isTokenValid')
+            ->with(new CsrfToken('Symfony\Component\Form\Extension\Core\Type\FormType', 'token'))
+            ->will($this->returnValue($valid));
+
+        $form = $this->factory
+            ->createNamedBuilder('', 'Symfony\Component\Form\Extension\Core\Type\FormType', null, array(
+                'csrf_field_name' => 'csrf',
+                'csrf_token_manager' => $this->tokenManager,
+                'compound' => true,
+            ))
+            ->add('child', 'Symfony\Component\Form\Extension\Core\Type\TextType')
+            ->getForm();
+
+        $form->submit(array(
+            'child' => 'foobar',
+            'csrf' => 'token',
+        ));
+
+        // Remove token from data
+        $this->assertSame(array('child' => 'foobar'), $form->getData());
+
+        // Validate accordingly
+        $this->assertSame($valid, $form->isValid());
+    }
+
+    public function testFailIfRootAndCompoundAndTokenMissing()
+    {
+        $this->tokenManager->expects($this->never())
+            ->method('isTokenValid');
+
+        $form = $this->factory
+            ->createBuilder('Symfony\Component\Form\Extension\Core\Type\FormType', null, array(
+                'csrf_field_name' => 'csrf',
+                'csrf_token_manager' => $this->tokenManager,
+                'csrf_token_id' => 'TOKEN_ID',
+                'compound' => true,
+            ))
+            ->add('child', 'Symfony\Component\Form\Extension\Core\Type\TextType')
+            ->getForm();
+
+        $form->submit(array(
+            'child' => 'foobar',
+            // token is missing
+        ));
+
+        // Remove token from data
+        $this->assertSame(array('child' => 'foobar'), $form->getData());
+
+        // Validate accordingly
+        $this->assertFalse($form->isValid());
+    }
+
+    public function testDontValidateTokenIfCompoundButNoRoot()
+    {
+        $this->tokenManager->expects($this->never())
+            ->method('isTokenValid');
+
+        $form = $this->factory
+            ->createNamedBuilder('root', 'Symfony\Component\Form\Extension\Core\Type\FormType')
+            ->add($this->factory
+                ->createNamedBuilder('form', 'Symfony\Component\Form\Extension\Core\Type\FormType', null, array(
+                    'csrf_field_name' => 'csrf',
+                    'csrf_token_manager' => $this->tokenManager,
+                    'csrf_token_id' => 'TOKEN_ID',
+                    'compound' => true,
+                ))
+            )
+            ->getForm()
+            ->get('form');
+
+        $form->submit(array(
+            'child' => 'foobar',
+            'csrf' => 'token',
+        ));
+    }
+
+    public function testDontValidateTokenIfRootButNotCompound()
+    {
+        $this->tokenManager->expects($this->never())
+            ->method('isTokenValid');
+
+        $form = $this->factory
+            ->create('Symfony\Component\Form\Extension\Core\Type\FormType', null, array(
+                'csrf_field_name' => 'csrf',
+                'csrf_token_manager' => $this->tokenManager,
+                'csrf_token_id' => 'TOKEN_ID',
+                'compound' => false,
+            ));
+
+        $form->submit(array(
+            'csrf' => 'token',
+        ));
+    }
+
+    public function testNoCsrfProtectionOnPrototype()
+    {
+        $prototypeView = $this->factory
+            ->create('Symfony\Component\Form\Extension\Core\Type\CollectionType', null, array(
+                'entry_type' => __CLASS__.'_ChildType',
+                'entry_options' => array(
+                    'csrf_field_name' => 'csrf',
+                ),
+                'prototype' => true,
+                'allow_add' => true,
+            ))
+            ->createView()
+            ->vars['prototype'];
+
+        $this->assertFalse(isset($prototypeView['csrf']));
+        $this->assertCount(1, $prototypeView);
+    }
+
+    public function testsTranslateCustomErrorMessage()
+    {
+        $this->tokenManager->expects($this->once())
+            ->method('isTokenValid')
+            ->with(new CsrfToken('TOKEN_ID', 'token'))
+            ->will($this->returnValue(false));
+
+        $this->translator->expects($this->once())
+             ->method('trans')
+             ->with('Foobar')
+             ->will($this->returnValue('[trans]Foobar[/trans]'));
+
+        $form = $this->factory
+            ->createBuilder('Symfony\Component\Form\Extension\Core\Type\FormType', null, array(
+                'csrf_field_name' => 'csrf',
+                'csrf_token_manager' => $this->tokenManager,
+                'csrf_message' => 'Foobar',
+                'csrf_token_id' => 'TOKEN_ID',
+                'compound' => true,
+            ))
+            ->getForm();
+
+        $form->submit(array(
+            'csrf' => 'token',
+        ));
+
+        $errors = $form->getErrors();
+        $expected = new FormError('[trans]Foobar[/trans]');
+        $expected->setOrigin($form);
+
+        $this->assertGreaterThan(0, count($errors));
+        $this->assertEquals($expected, $errors[0]);
+    }
+}