CsrfValidatorTest.php

Go to the documentation of this file.

<?php
declare(strict_types=1);

namespace Magento\Framework\App\Request;

use Magento\Framework\App\ActionInterface;
use Magento\Framework\App\CsrfAwareActionInterface;
use Magento\Framework\App\RequestInterface;
use Magento\Framework\Controller\Result\Redirect;
use Magento\Framework\Controller\Result\RedirectFactory;
use Magento\Framework\Data\Form\FormKey;
use Magento\Framework\Exception\NotFoundException;
use Magento\Framework\Phrase;
use PHPUnit\Framework\TestCase;
use Magento\TestFramework\Helper\Bootstrap;
use Magento\Framework\App\Request\Http as HttpRequest;
use Zend\Stdlib\Parameters;
use Magento\Framework\App\Response\Http as HttpResponse;
use Magento\Framework\App\Response\HttpFactory as HttpResponseFactory;

class CsrfValidatorTest extends TestCase
{
    private const AWARE_URL = 'test/1';

    private const AWARE_VALIDATION_PARAM = 'test_param';

    private const AWARE_MESSAGE = 'custom validation failed';

    private $mockUnawareAction;

    private $mockAwareAction;

    private $validator;

    private $request;

    private $formKey;

    private $httpResponseFactory;

    private function createUnawareAction(): ActionInterface
    {
        return new class implements ActionInterface {
            public function execute()
            {
                throw new NotFoundException(new Phrase('Not implemented'));
            }
        };
    }

    private function createAwareAction(): ActionInterface
    {
        $u = self::AWARE_URL;
        $m = self::AWARE_MESSAGE;
        $p = self::AWARE_VALIDATION_PARAM;

        return new class($u, $m, $p) implements CsrfAwareActionInterface {
            private $url;

            private $message;

            private $param;

            public function __construct(
                string $url,
                string $message,
                string $param
            ) {
                $this->url = $url;
                $this->message = $message;
                $this->param = $param;
            }

            public function execute()
            {
                throw new NotFoundException(new Phrase('Not implemented'));
            }

            public function createCsrfValidationException(
                RequestInterface $request
            ): ?InvalidRequestException {
                $redirectFactory = Bootstrap::getObjectManager()
                    ->get(RedirectFactory::class);
                $redirect = $redirectFactory->create();
                $redirect->setUrl($this->url);

                return new InvalidRequestException(
                    $redirect,
                    [new Phrase($this->message)]
                );
            }

            public function validateForCsrf(RequestInterface $request): ?bool
            {
                return (bool)$request->getParam($this->param);
            }
        };
    }

    protected function setUp()
    {
        $objectManager = Bootstrap::getObjectManager();
        $this->request = $objectManager->get(HttpRequest::class);
        $this->validator = $objectManager->get(CsrfValidator::class);
        $this->mockUnawareAction = $this->createUnawareAction();
        $this->mockAwareAction = $this->createAwareAction();
        $this->formKey = $objectManager->get(FormKey::class);
        $this->httpResponseFactory = $objectManager->get(
            HttpResponseFactory::class
        );
    }

    public function testValidateInWrongArea()
    {
        $this->request->setMethod(HttpRequest::METHOD_POST);
        $this->validator->validate(
            $this->request,
            $this->mockUnawareAction
        );
    }

    public function testValidateWithValidKey()
    {
        $this->request->setPost(
            new Parameters(['form_key' => $this->formKey->getFormKey()])
        );
        $this->request->setMethod(HttpRequest::METHOD_POST);

        $this->validator->validate(
            $this->request,
            $this->mockUnawareAction
        );
    }

    public function testValidateWithInvalidKey()
    {
        $this->request->setPost(
            new Parameters(['form_key' => $this->formKey->getFormKey() .'1'])
        );
        $this->request->setMethod(HttpRequest::METHOD_POST);

        $this->validator->validate(
            $this->request,
            $this->mockUnawareAction
        );
    }

    public function testValidateInvalidWithAwareAction()
    {
        $this->request->setMethod(HttpRequest::METHOD_POST);

        $caught = null;
        try {
            $this->validator->validate(
                $this->request,
                $this->mockAwareAction
            );
        } catch (InvalidRequestException $exception) {
            $caught = $exception;
        }

        $this->assertNotNull($caught);
        $this->assertInstanceOf(Redirect::class, $caught->getReplaceResult());
        $response = $this->httpResponseFactory->create();
        $caught->getReplaceResult()->renderResult($response);
        $this->assertContains(
            self::AWARE_URL,
            $response->getHeaders()->toString()
        );
        $this->assertCount(1, $caught->getMessages());
        $this->assertEquals(
            self::AWARE_MESSAGE,
            $caught->getMessages()[0]->getText()
        );
    }

    public function testValidateValidWithAwareAction()
    {
        $this->request->setMethod(HttpRequest::METHOD_POST);
        $this->request->setPost(
            new Parameters([self::AWARE_VALIDATION_PARAM => '1'])
        );

        $this->validator->validate(
            $this->request,
            $this->mockAwareAction
        );
    }
}