Actualización

vendor/symfony/security/Csrf/Tests/CsrfTokenManagerTest.php

@@ -0,0 +1,224 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Csrf\Tests;
+
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\RequestStack;
+use Symfony\Component\Security\Csrf\CsrfToken;
+use Symfony\Component\Security\Csrf\CsrfTokenManager;
+
+/**
+ * @author Bernhard Schussek <bschussek@gmail.com>
+ */
+class CsrfTokenManagerTest extends TestCase
+{
+    /**
+     * @dataProvider getManagerGeneratorAndStorage
+     */
+    public function testGetNonExistingToken($namespace, $manager, $storage, $generator)
+    {
+        $storage->expects($this->once())
+            ->method('hasToken')
+            ->with($namespace.'token_id')
+            ->will($this->returnValue(false));
+
+        $generator->expects($this->once())
+            ->method('generateToken')
+            ->will($this->returnValue('TOKEN'));
+
+        $storage->expects($this->once())
+            ->method('setToken')
+            ->with($namespace.'token_id', 'TOKEN');
+
+        $token = $manager->getToken('token_id');
+
+        $this->assertInstanceOf('Symfony\Component\Security\Csrf\CsrfToken', $token);
+        $this->assertSame('token_id', $token->getId());
+        $this->assertSame('TOKEN', $token->getValue());
+    }
+
+    /**
+     * @dataProvider getManagerGeneratorAndStorage
+     */
+    public function testUseExistingTokenIfAvailable($namespace, $manager, $storage)
+    {
+        $storage->expects($this->once())
+            ->method('hasToken')
+            ->with($namespace.'token_id')
+            ->will($this->returnValue(true));
+
+        $storage->expects($this->once())
+            ->method('getToken')
+            ->with($namespace.'token_id')
+            ->will($this->returnValue('TOKEN'));
+
+        $token = $manager->getToken('token_id');
+
+        $this->assertInstanceOf('Symfony\Component\Security\Csrf\CsrfToken', $token);
+        $this->assertSame('token_id', $token->getId());
+        $this->assertSame('TOKEN', $token->getValue());
+    }
+
+    /**
+     * @dataProvider getManagerGeneratorAndStorage
+     */
+    public function testRefreshTokenAlwaysReturnsNewToken($namespace, $manager, $storage, $generator)
+    {
+        $storage->expects($this->never())
+            ->method('hasToken');
+
+        $generator->expects($this->once())
+            ->method('generateToken')
+            ->will($this->returnValue('TOKEN'));
+
+        $storage->expects($this->once())
+            ->method('setToken')
+            ->with($namespace.'token_id', 'TOKEN');
+
+        $token = $manager->refreshToken('token_id');
+
+        $this->assertInstanceOf('Symfony\Component\Security\Csrf\CsrfToken', $token);
+        $this->assertSame('token_id', $token->getId());
+        $this->assertSame('TOKEN', $token->getValue());
+    }
+
+    /**
+     * @dataProvider getManagerGeneratorAndStorage
+     */
+    public function testMatchingTokenIsValid($namespace, $manager, $storage)
+    {
+        $storage->expects($this->once())
+            ->method('hasToken')
+            ->with($namespace.'token_id')
+            ->will($this->returnValue(true));
+
+        $storage->expects($this->once())
+            ->method('getToken')
+            ->with($namespace.'token_id')
+            ->will($this->returnValue('TOKEN'));
+
+        $this->assertTrue($manager->isTokenValid(new CsrfToken('token_id', 'TOKEN')));
+    }
+
+    /**
+     * @dataProvider getManagerGeneratorAndStorage
+     */
+    public function testNonMatchingTokenIsNotValid($namespace, $manager, $storage)
+    {
+        $storage->expects($this->once())
+            ->method('hasToken')
+            ->with($namespace.'token_id')
+            ->will($this->returnValue(true));
+
+        $storage->expects($this->once())
+            ->method('getToken')
+            ->with($namespace.'token_id')
+            ->will($this->returnValue('TOKEN'));
+
+        $this->assertFalse($manager->isTokenValid(new CsrfToken('token_id', 'FOOBAR')));
+    }
+
+    /**
+     * @dataProvider getManagerGeneratorAndStorage
+     */
+    public function testNonExistingTokenIsNotValid($namespace, $manager, $storage)
+    {
+        $storage->expects($this->once())
+            ->method('hasToken')
+            ->with($namespace.'token_id')
+            ->will($this->returnValue(false));
+
+        $storage->expects($this->never())
+            ->method('getToken');
+
+        $this->assertFalse($manager->isTokenValid(new CsrfToken('token_id', 'FOOBAR')));
+    }
+
+    /**
+     * @dataProvider getManagerGeneratorAndStorage
+     */
+    public function testRemoveToken($namespace, $manager, $storage)
+    {
+        $storage->expects($this->once())
+            ->method('removeToken')
+            ->with($namespace.'token_id')
+            ->will($this->returnValue('REMOVED_TOKEN'));
+
+        $this->assertSame('REMOVED_TOKEN', $manager->removeToken('token_id'));
+    }
+
+    public function testNamespaced()
+    {
+        $generator = $this->getMockBuilder('Symfony\Component\Security\Csrf\TokenGenerator\TokenGeneratorInterface')->getMock();
+        $storage = $this->getMockBuilder('Symfony\Component\Security\Csrf\TokenStorage\TokenStorageInterface')->getMock();
+
+        $requestStack = new RequestStack();
+        $requestStack->push(new Request(array(), array(), array(), array(), array(), array('HTTPS' => 'on')));
+
+        $manager = new CsrfTokenManager($generator, $storage, null, $requestStack);
+
+        $token = $manager->getToken('foo');
+        $this->assertSame('foo', $token->getId());
+    }
+
+    public function getManagerGeneratorAndStorage()
+    {
+        $data = array();
+
+        list($generator, $storage) = $this->getGeneratorAndStorage();
+        $data[] = array('', new CsrfTokenManager($generator, $storage, ''), $storage, $generator);
+
+        list($generator, $storage) = $this->getGeneratorAndStorage();
+        $data[] = array('https-', new CsrfTokenManager($generator, $storage), $storage, $generator);
+
+        list($generator, $storage) = $this->getGeneratorAndStorage();
+        $data[] = array('aNamespace-', new CsrfTokenManager($generator, $storage, 'aNamespace-'), $storage, $generator);
+
+        $requestStack = new RequestStack();
+        $requestStack->push(new Request(array(), array(), array(), array(), array(), array('HTTPS' => 'on')));
+        list($generator, $storage) = $this->getGeneratorAndStorage();
+        $data[] = array('https-', new CsrfTokenManager($generator, $storage, $requestStack), $storage, $generator);
+
+        list($generator, $storage) = $this->getGeneratorAndStorage();
+        $data[] = array('generated-', new CsrfTokenManager($generator, $storage, function () {
+            return 'generated-';
+        }), $storage, $generator);
+
+        $requestStack = new RequestStack();
+        $requestStack->push(new Request());
+        list($generator, $storage) = $this->getGeneratorAndStorage();
+        $data[] = array('', new CsrfTokenManager($generator, $storage, $requestStack), $storage, $generator);
+
+        return $data;
+    }
+
+    private function getGeneratorAndStorage()
+    {
+        return array(
+            $this->getMockBuilder('Symfony\Component\Security\Csrf\TokenGenerator\TokenGeneratorInterface')->getMock(),
+            $this->getMockBuilder('Symfony\Component\Security\Csrf\TokenStorage\TokenStorageInterface')->getMock(),
+        );
+    }
+
+    public function setUp()
+    {
+        $_SERVER['HTTPS'] = 'on';
+    }
+
+    public function tearDown()
+    {
+        parent::tearDown();
+
+        unset($_SERVER['HTTPS']);
+    }
+}

vendor/symfony/security/Csrf/Tests/TokenGenerator/UriSafeTokenGeneratorTest.php

@@ -0,0 +1,60 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Csrf\Tests\TokenGenerator;
+
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Security\Csrf\TokenGenerator\UriSafeTokenGenerator;
+
+/**
+ * @author Bernhard Schussek <bschussek@gmail.com>
+ */
+class UriSafeTokenGeneratorTest extends TestCase
+{
+    const ENTROPY = 1000;
+
+    /**
+     * A non alpha-numeric byte string.
+     *
+     * @var string
+     */
+    private static $bytes;
+
+    /**
+     * @var UriSafeTokenGenerator
+     */
+    private $generator;
+
+    public static function setUpBeforeClass()
+    {
+        self::$bytes = base64_decode('aMf+Tct/RLn2WQ==');
+    }
+
+    protected function setUp()
+    {
+        $this->generator = new UriSafeTokenGenerator(self::ENTROPY);
+    }
+
+    protected function tearDown()
+    {
+        $this->generator = null;
+    }
+
+    public function testGenerateToken()
+    {
+        $token = $this->generator->generateToken();
+
+        $this->assertTrue(ctype_print($token), 'is printable');
+        $this->assertStringNotMatchesFormat('%S+%S', $token, 'is URI safe');
+        $this->assertStringNotMatchesFormat('%S/%S', $token, 'is URI safe');
+        $this->assertStringNotMatchesFormat('%S=%S', $token, 'is URI safe');
+    }
+}

vendor/symfony/security/Csrf/Tests/TokenStorage/NativeSessionTokenStorageTest.php

@@ -0,0 +1,124 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Csrf\Tests\TokenStorage;
+
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Security\Csrf\TokenStorage\NativeSessionTokenStorage;
+
+/**
+ * @author Bernhard Schussek <bschussek@gmail.com>
+ *
+ * @runTestsInSeparateProcesses
+ * @preserveGlobalState disabled
+ */
+class NativeSessionTokenStorageTest extends TestCase
+{
+    const SESSION_NAMESPACE = 'foobar';
+
+    /**
+     * @var NativeSessionTokenStorage
+     */
+    private $storage;
+
+    public static function setUpBeforeClass()
+    {
+        ini_set('session.save_handler', 'files');
+        ini_set('session.save_path', sys_get_temp_dir());
+
+        parent::setUpBeforeClass();
+    }
+
+    protected function setUp()
+    {
+        $_SESSION = array();
+
+        $this->storage = new NativeSessionTokenStorage(self::SESSION_NAMESPACE);
+    }
+
+    public function testStoreTokenInClosedSession()
+    {
+        $this->storage->setToken('token_id', 'TOKEN');
+
+        $this->assertSame(array(self::SESSION_NAMESPACE => array('token_id' => 'TOKEN')), $_SESSION);
+    }
+
+    public function testStoreTokenInClosedSessionWithExistingSessionId()
+    {
+        session_id('foobar');
+
+        $this->assertSame(PHP_SESSION_NONE, session_status());
+
+        $this->storage->setToken('token_id', 'TOKEN');
+
+        $this->assertSame(PHP_SESSION_ACTIVE, session_status());
+        $this->assertSame(array(self::SESSION_NAMESPACE => array('token_id' => 'TOKEN')), $_SESSION);
+    }
+
+    public function testStoreTokenInActiveSession()
+    {
+        session_start();
+
+        $this->storage->setToken('token_id', 'TOKEN');
+
+        $this->assertSame(array(self::SESSION_NAMESPACE => array('token_id' => 'TOKEN')), $_SESSION);
+    }
+
+    /**
+     * @depends testStoreTokenInClosedSession
+     */
+    public function testCheckToken()
+    {
+        $this->assertFalse($this->storage->hasToken('token_id'));
+
+        $this->storage->setToken('token_id', 'TOKEN');
+
+        $this->assertTrue($this->storage->hasToken('token_id'));
+    }
+
+    /**
+     * @depends testStoreTokenInClosedSession
+     */
+    public function testGetExistingToken()
+    {
+        $this->storage->setToken('token_id', 'TOKEN');
+
+        $this->assertSame('TOKEN', $this->storage->getToken('token_id'));
+    }
+
+    /**
+     * @expectedException \Symfony\Component\Security\Csrf\Exception\TokenNotFoundException
+     */
+    public function testGetNonExistingToken()
+    {
+        $this->storage->getToken('token_id');
+    }
+
+    /**
+     * @depends testCheckToken
+     */
+    public function testRemoveNonExistingToken()
+    {
+        $this->assertNull($this->storage->removeToken('token_id'));
+        $this->assertFalse($this->storage->hasToken('token_id'));
+    }
+
+    /**
+     * @depends testCheckToken
+     */
+    public function testRemoveExistingToken()
+    {
+        $this->storage->setToken('token_id', 'TOKEN');
+
+        $this->assertSame('TOKEN', $this->storage->removeToken('token_id'));
+        $this->assertFalse($this->storage->hasToken('token_id'));
+    }
+}

vendor/symfony/security/Csrf/Tests/TokenStorage/SessionTokenStorageTest.php

@@ -0,0 +1,259 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Csrf\Tests\TokenStorage;
+
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Security\Csrf\TokenStorage\SessionTokenStorage;
+
+/**
+ * @author Bernhard Schussek <bschussek@gmail.com>
+ */
+class SessionTokenStorageTest extends TestCase
+{
+    const SESSION_NAMESPACE = 'foobar';
+
+    /**
+     * @var \PHPUnit_Framework_MockObject_MockObject
+     */
+    private $session;
+
+    /**
+     * @var SessionTokenStorage
+     */
+    private $storage;
+
+    protected function setUp()
+    {
+        $this->session = $this->getMockBuilder('Symfony\Component\HttpFoundation\Session\SessionInterface')
+            ->disableOriginalConstructor()
+            ->getMock();
+        $this->storage = new SessionTokenStorage($this->session, self::SESSION_NAMESPACE);
+    }
+
+    public function testStoreTokenInClosedSession()
+    {
+        $this->session->expects($this->any())
+            ->method('isStarted')
+            ->will($this->returnValue(false));
+
+        $this->session->expects($this->once())
+            ->method('start');
+
+        $this->session->expects($this->once())
+            ->method('set')
+            ->with(self::SESSION_NAMESPACE.'/token_id', 'TOKEN');
+
+        $this->storage->setToken('token_id', 'TOKEN');
+    }
+
+    public function testStoreTokenInActiveSession()
+    {
+        $this->session->expects($this->any())
+            ->method('isStarted')
+            ->will($this->returnValue(true));
+
+        $this->session->expects($this->never())
+            ->method('start');
+
+        $this->session->expects($this->once())
+            ->method('set')
+            ->with(self::SESSION_NAMESPACE.'/token_id', 'TOKEN');
+
+        $this->storage->setToken('token_id', 'TOKEN');
+    }
+
+    public function testCheckTokenInClosedSession()
+    {
+        $this->session->expects($this->any())
+            ->method('isStarted')
+            ->will($this->returnValue(false));
+
+        $this->session->expects($this->once())
+            ->method('start');
+
+        $this->session->expects($this->once())
+            ->method('has')
+            ->with(self::SESSION_NAMESPACE.'/token_id')
+            ->will($this->returnValue('RESULT'));
+
+        $this->assertSame('RESULT', $this->storage->hasToken('token_id'));
+    }
+
+    public function testCheckTokenInActiveSession()
+    {
+        $this->session->expects($this->any())
+            ->method('isStarted')
+            ->will($this->returnValue(true));
+
+        $this->session->expects($this->never())
+            ->method('start');
+
+        $this->session->expects($this->once())
+            ->method('has')
+            ->with(self::SESSION_NAMESPACE.'/token_id')
+            ->will($this->returnValue('RESULT'));
+
+        $this->assertSame('RESULT', $this->storage->hasToken('token_id'));
+    }
+
+    public function testGetExistingTokenFromClosedSession()
+    {
+        $this->session->expects($this->any())
+            ->method('isStarted')
+            ->will($this->returnValue(false));
+
+        $this->session->expects($this->once())
+            ->method('start');
+
+        $this->session->expects($this->once())
+            ->method('has')
+            ->with(self::SESSION_NAMESPACE.'/token_id')
+            ->will($this->returnValue(true));
+
+        $this->session->expects($this->once())
+            ->method('get')
+            ->with(self::SESSION_NAMESPACE.'/token_id')
+            ->will($this->returnValue('RESULT'));
+
+        $this->assertSame('RESULT', $this->storage->getToken('token_id'));
+    }
+
+    public function testGetExistingTokenFromActiveSession()
+    {
+        $this->session->expects($this->any())
+            ->method('isStarted')
+            ->will($this->returnValue(true));
+
+        $this->session->expects($this->never())
+            ->method('start');
+
+        $this->session->expects($this->once())
+            ->method('has')
+            ->with(self::SESSION_NAMESPACE.'/token_id')
+            ->will($this->returnValue(true));
+
+        $this->session->expects($this->once())
+            ->method('get')
+            ->with(self::SESSION_NAMESPACE.'/token_id')
+            ->will($this->returnValue('RESULT'));
+
+        $this->assertSame('RESULT', $this->storage->getToken('token_id'));
+    }
+
+    /**
+     * @expectedException \Symfony\Component\Security\Csrf\Exception\TokenNotFoundException
+     */
+    public function testGetNonExistingTokenFromClosedSession()
+    {
+        $this->session->expects($this->any())
+            ->method('isStarted')
+            ->will($this->returnValue(false));
+
+        $this->session->expects($this->once())
+            ->method('start');
+
+        $this->session->expects($this->once())
+            ->method('has')
+            ->with(self::SESSION_NAMESPACE.'/token_id')
+            ->will($this->returnValue(false));
+
+        $this->storage->getToken('token_id');
+    }
+
+    /**
+     * @expectedException \Symfony\Component\Security\Csrf\Exception\TokenNotFoundException
+     */
+    public function testGetNonExistingTokenFromActiveSession()
+    {
+        $this->session->expects($this->any())
+            ->method('isStarted')
+            ->will($this->returnValue(true));
+
+        $this->session->expects($this->never())
+            ->method('start');
+
+        $this->session->expects($this->once())
+            ->method('has')
+            ->with(self::SESSION_NAMESPACE.'/token_id')
+            ->will($this->returnValue(false));
+
+        $this->storage->getToken('token_id');
+    }
+
+    public function testRemoveNonExistingTokenFromClosedSession()
+    {
+        $this->session->expects($this->any())
+            ->method('isStarted')
+            ->will($this->returnValue(false));
+
+        $this->session->expects($this->once())
+            ->method('start');
+
+        $this->session->expects($this->once())
+            ->method('remove')
+            ->with(self::SESSION_NAMESPACE.'/token_id')
+            ->will($this->returnValue(null));
+
+        $this->assertNull($this->storage->removeToken('token_id'));
+    }
+
+    public function testRemoveNonExistingTokenFromActiveSession()
+    {
+        $this->session->expects($this->any())
+            ->method('isStarted')
+            ->will($this->returnValue(true));
+
+        $this->session->expects($this->never())
+            ->method('start');
+
+        $this->session->expects($this->once())
+            ->method('remove')
+            ->with(self::SESSION_NAMESPACE.'/token_id')
+            ->will($this->returnValue(null));
+
+        $this->assertNull($this->storage->removeToken('token_id'));
+    }
+
+    public function testRemoveExistingTokenFromClosedSession()
+    {
+        $this->session->expects($this->any())
+            ->method('isStarted')
+            ->will($this->returnValue(false));
+
+        $this->session->expects($this->once())
+            ->method('start');
+
+        $this->session->expects($this->once())
+            ->method('remove')
+            ->with(self::SESSION_NAMESPACE.'/token_id')
+            ->will($this->returnValue('TOKEN'));
+
+        $this->assertSame('TOKEN', $this->storage->removeToken('token_id'));
+    }
+
+    public function testRemoveExistingTokenFromActiveSession()
+    {
+        $this->session->expects($this->any())
+            ->method('isStarted')
+            ->will($this->returnValue(true));
+
+        $this->session->expects($this->never())
+            ->method('start');
+
+        $this->session->expects($this->once())
+            ->method('remove')
+            ->with(self::SESSION_NAMESPACE.'/token_id')
+            ->will($this->returnValue('TOKEN'));
+
+        $this->assertSame('TOKEN', $this->storage->removeToken('token_id'));
+    }
+}