Merge commit from fork

Author: cedric-anne

phpunit/functional/Glpi/Toolbox/URLTest.php

@@ -40,83 +40,128 @@ class URLTest extends \GLPITestCase
     public static function urlProvider(): iterable
     {
         yield [
-            'url'      => null,
-            'expected' => '',
+            'url'       => null,
+            'sanitized' => '',
+            'relative'  => false,
         ];
         yield [
-            'url'      => '',
-            'expected' => '',
+            'url'       => '',
+            'sanitized' => '',
+            'relative'  => false,
         ];
 
         // Javascript URL
         yield [
-            'url'      => 'javascript:alert(1);',
-            'expected' => '',
+            'url'       => 'javascript:alert(1);',
+            'sanitized' => '',
+            'relative'  => false,
         ];
         yield [
-            'url'      => "java\nscript:alert(1);",
-            'expected' => '',
+            'url'       => "java\nscript:alert(1);",
+            'sanitized' => '',
+            'relative'  => false,
         ];
         yield [
-            'url'      => "j a v\t\ta\n  s c \t ript  :alert(1);",
-            'expected' => '',
+            'url'       => "j a v\t\ta\n  s c \t ript  :alert(1);",
+            'sanitized' => '',
+            'relative'  => false,
         ];
         yield [
-            'url'      => 'jAvAscrIPt:alert(1);',
-            'expected' => '',
+            'url'       => 'jAvAscrIPt:alert(1);',
+            'sanitized' => '',
+            'relative'  => false,
         ];
         yield [
-            'url'      => 'javascript:alert(1);" title="XSS!"',
-            'expected' => '',
+            'url'       => 'javascript:alert(1);" title="XSS!"',
+            'sanitized' => '',
+            'relative'  => false,
         ];
         yield [
-            'url'      => 'javascript:alert(1)',
-            'expected' => '',
+            'url'       => 'javascript:alert(1)',
+            'sanitized' => '',
+            'relative'  => false,
         ];
         yield [
-            'url'      => 'javascript://%0aalert();',
-            'expected' => '',
+            'url'       => 'javascript://%0aalert();',
+            'sanitized' => '',
+            'relative'  => false,
         ];
 
         // Invalid URL
         yield [
-            'url'      => 'ht tp://www.domain.tld/test',
-            'expected' => '',
+            'url'       => 'ht tp://www.domain.tld/test',
+            'sanitized' => '',
+            'relative'  => false,
         ];
         yield [
-            'url'      => 'http:/www.domain.tld/test',
-            'expected' => '',
+            'url'       => 'http:/www.domain.tld/test',
+            'sanitized' => '',
+            'relative'  => false,
         ];
         yield [
-            'url'      => '15//test',
-            'expected' => '',
+            'url'       => '15//test',
+            'sanitized' => '',
+            'relative'  => false,
         ];
 
         // Sane URL
         yield [
-            'url'      => 'http://www.domain.tld/test',
-            'expected' => 'http://www.domain.tld/test',
+            'url'       => 'http://www.domain.tld/test',
+            'sanitized' => 'http://www.domain.tld/test',
+            'relative'  => false,
         ];
         yield [
-            'url'      => '//hostname/path/to/file',
-            'expected' => '//hostname/path/to/file',
+            'url'       => '//hostname/path/to/file',
+            'sanitized' => '//hostname/path/to/file',
+            'relative'  => false,
         ];
         yield [
-            'url'      => '/test?abc=12',
-            'expected' => '/test?abc=12',
+            'url'       => '/test?abc=12',
+            'sanitized' => '/test?abc=12',
+            'relative'  => true,
         ];
         yield [
-            'url'      => '/',
-            'expected' => '/',
+            'url'       => '/Path/To/Resource/15',
+            'sanitized' => '/Path/To/Resource/15',
+            'relative'  => true,
         ];
+        yield [
+            'url'       => '/',
+            'sanitized' => '/',
+            'relative'  => true,
+        ];
+        yield [
+            'url'       => '/.hiddenfile',
+            'sanitized' => '/.hiddenfile',
+            'relative'  => false, // not considered as a valid relative URL, as it exposes an hidden resource
+        ];
+        yield [
+            'url'       => '/front/.hidden.php',
+            'sanitized' => '/front/.hidden.php',
+            'relative'  => false, // not considered as a valid relative URL, as it exposes an hidden resource
+        ];
+        yield [
+            'url'       => '/front/../../oustideglpi.php',
+            'sanitized' => '/front/../../oustideglpi.php',
+            'relative'  => false, // not considered as a valid relative URL, as it contains a `/..` token that may expose paths outside GLPI
+        ];
+    }
+
+    /**
+     * @dataProvider urlProvider
+     */
+    public function testSanitizeURL(?string $url, string $sanitized, bool $relative): void
+    {
+        $instance = new \Glpi\Toolbox\URL();
+        $this->assertEquals($sanitized, $instance->sanitizeURL($url));
     }
 
     /**
      * @dataProvider urlProvider
      */
-    public function testSanitizeURL(?string $url, string $expected): void
+    public function testIsGLPIRelativeUrl(?string $url, string $sanitized, bool $relative): void
     {
         $instance = new \Glpi\Toolbox\URL();
-        $this->assertEquals($expected, $instance->sanitizeURL($url));
+        $this->assertEquals($relative, $instance->isGLPIRelativeUrl((string) $url));
     }
 }