44 lines
1.2 KiB
PHP
44 lines
1.2 KiB
PHP
<?php
|
|
|
|
namespace Tests\Unit\Firewall;
|
|
|
|
use Akaunting\Firewall\Middleware\Xss;
|
|
use Illuminate\Http\Request;
|
|
use Tests\TestCase;
|
|
|
|
class LivewireXssExclusionTest extends TestCase
|
|
{
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
|
|
config(['firewall.middleware.xss.enabled' => true]);
|
|
}
|
|
|
|
public function test_signed_livewire_snapshot_is_excluded_from_xss_scanning(): void
|
|
{
|
|
$middleware = new Xss();
|
|
$middleware->prepare(Request::create('/1/livewire/update', 'POST'));
|
|
|
|
$this->assertFalse($middleware->match(
|
|
$middleware->getPatterns()[4],
|
|
['components' => [['snapshot' => '{"data":{"product_name":"<img src=x>"}}']]],
|
|
));
|
|
}
|
|
|
|
public function test_livewire_user_updates_and_regular_fields_remain_protected(): void
|
|
{
|
|
$middleware = new Xss();
|
|
$middleware->prepare(Request::create('/1/livewire/update', 'POST'));
|
|
|
|
$this->assertSame(1, $middleware->match(
|
|
$middleware->getPatterns()[4],
|
|
['components' => [['updates' => ['name' => '<img src=x>']]]],
|
|
));
|
|
$this->assertSame(1, $middleware->match(
|
|
$middleware->getPatterns()[4],
|
|
['name' => '<img src=x>'],
|
|
));
|
|
}
|
|
}
|