c6c7ec1c31
Use shared domain validation and normalization for application, service, and preview domains so unsafe host input is rejected consistently. Cover command-substitution payloads in application domain tests.
55 lines
1.9 KiB
PHP
55 lines
1.9 KiB
PHP
<?php
|
|
|
|
use App\Livewire\Project\Application\General;
|
|
|
|
it('uses safe domain validation rules in the application general form', function () {
|
|
$component = new General;
|
|
$method = new ReflectionMethod($component, 'rules');
|
|
$rules = $method->invoke($component);
|
|
|
|
$validator = validator([
|
|
'fqdn' => 'http://$(whoami).example.com',
|
|
], [
|
|
'fqdn' => $rules['fqdn'],
|
|
]);
|
|
|
|
expect($validator->fails())->toBeTrue()
|
|
->and($validator->errors()->has('fqdn'))->toBeTrue();
|
|
});
|
|
|
|
it('uses safe docker compose service domain validation rules in the application general form', function () {
|
|
$component = new General;
|
|
$method = new ReflectionMethod($component, 'rules');
|
|
$rules = $method->invoke($component);
|
|
|
|
$validator = validator([
|
|
'parsedServiceDomains' => [
|
|
'app' => [
|
|
'domain' => 'http://$(whoami).example.com',
|
|
],
|
|
],
|
|
], [
|
|
'parsedServiceDomains.*.domain' => $rules['parsedServiceDomains.*.domain'],
|
|
]);
|
|
|
|
expect($validator->fails())->toBeTrue()
|
|
->and($validator->errors()->has('parsedServiceDomains.app.domain'))->toBeTrue();
|
|
});
|
|
|
|
it('uses safe docker registry image validation rules in the application general form', function () {
|
|
$component = new General;
|
|
$method = new ReflectionMethod($component, 'rules');
|
|
$rules = $method->invoke($component);
|
|
|
|
$validator = validator([
|
|
'dockerRegistryImageName' => 'coolify/poc$(touch /tmp/pwned)',
|
|
'dockerRegistryImageTag' => 'latest$(touch /tmp/pwned)',
|
|
], [
|
|
'dockerRegistryImageName' => $rules['dockerRegistryImageName'],
|
|
'dockerRegistryImageTag' => $rules['dockerRegistryImageTag'],
|
|
]);
|
|
|
|
expect($validator->fails())->toBeTrue()
|
|
->and($validator->errors()->has('dockerRegistryImageName'))->toBeTrue()
|
|
->and($validator->errors()->has('dockerRegistryImageTag'))->toBeTrue();
|
|
});
|