Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Finalize html encoding rework

Browse Source
This commit is contained in:
Matej Bačo
2026-02-23 12:54:20 +01:00
parent 2b6b66d8a4
commit 5414cc67ab
2 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/e2e/Services/Projects/ProjectsConsoleClientTest.php
+6 -5
View File
@@ -6662,7 +6662,7 @@ class ProjectsConsoleClientTest extends Scope
$this->assertStringContainsString($expectedUrl, $lastEmail['html']);
// With injection
// With injection (allowed, meant to be protected client-side)
$url = 'http://localhost/auth/signin\"></a><h1>INJECTED</h1>';
$response = $this->client->call(
@@ -6690,11 +6690,12 @@ class ProjectsConsoleClientTest extends Scope
$this->assertEquals('Password Reset for ' . $this->getProject()['name'], $lastEmail['subject']);
$this->assertStringContainsString('INJECTED', $lastEmail['html']);
$this->assertStringNotContainsString('<h1>', $lastEmail['html']);
$this->assertStringNotContainsString('</h1>', $lastEmail['html']);
$this->assertStringContainsString('<h1>', $lastEmail['html']);
$this->assertStringContainsString('</h1>', $lastEmail['html']);
$this->assertStringContainsString('">', $lastEmail['html']);
$this->assertStringContainsString('</a>', $lastEmail['html']);
$sanitizedUrl = \htmlentities($url);
$expectedUrl = $sanitizedUrl . "?userId=" . $userId . "&secret=";
$expectedUrl = $url . "?userId=" . $userId . "&secret=";
$this->assertStringContainsString($expectedUrl, $lastEmail['html']);
}
tests/e2e/Services/Teams/TeamsCustomClientTest.php
+4 -2
View File
@@ -157,9 +157,11 @@ class TeamsCustomClientTest extends Scope
'testTeamsInviteHTMLInjection' => $email
], JSON_PRETTY_PRINT));
$encoded = 'http://localhost:5000/join-us\&quot;&gt;&lt;/a&gt;&lt;h1&gt;INJECTED&lt;/h1&gt;?';
$this->assertStringNotContainsString('<h1>INJECTED</h1>', $email['html']);
// injection allowed, meant to be protected client-side
$encoded = 'http://localhost:5000/join-us\"></a><h1>INJECTED</h1>';
$this->assertStringContainsString('<h1>INJECTED</h1>', $email['html']);
$this->assertStringContainsString($encoded, $email['html']);
$response = $this->client->call(Client::METHOD_DELETE, '/teams/' . $teamUid . '/memberships/'.$response['body']['$id'], array_merge([