Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

tests: add tests for email injection

Browse Source
This commit is contained in:
Torsten Dittmann
2024-01-08 15:31:57 +01:00
parent 0d2eca4def
commit 6e65f2c943
3 changed files with 61 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/e2e/Services/Account/AccountBase.php
+61 -4
View File
@@ -10,11 +10,9 @@ use Utopia\Database\Validator\Datetime as DatetimeValidator;
trait AccountBase
{
public function testCreateAccount(): array
public function testCreateAccount($name = 'User Name', $password = 'password', $email = null): array
{
$email = uniqid() . 'user@localhost.test';
$password = 'password';
$name = 'User Name';
$email ??= uniqid() . 'user@localhost.test';
/**
* Test for SUCCESS
@@ -1554,4 +1552,63 @@ trait AccountBase
return $data;
}
public function testAccountEmailInjections()
{
$account = $this->testCreateAccount(name: '<html>test</html>');
$data = $this->testCreateAccountSession($account);
[
'session' => $session,
'email' => $email
] = $data;
/**
* Verification
*/
$response = $this->client->call(Client::METHOD_POST, '/account/verification', array_merge([
'origin' => 'http://localhost',
'content-type' => 'application/json',
'x-appwrite-project' => $this->getProject()['$id'],
'cookie' => 'a_session_' . $this->getProject()['$id'] . '=' . $session,
]), [
'url' => 'http://localhost/verification',
]);
$this->assertEquals(201, $response['headers']['status-code']);
$lastEmail = $this->getLastEmail();
$this->assertStringNotContainsString('<html>test</html>', $lastEmail['html']);
/**
* Recovery
*/
$response = $this->client->call(Client::METHOD_POST, '/account/recovery', array_merge([
'origin' => 'http://localhost',
'content-type' => 'application/json',
'x-appwrite-project' => $this->getProject()['$id'],
]), [
'email' => $email,
'url' => 'http://localhost/recovery',
]);
$this->assertEquals(201, $response['headers']['status-code']);
$lastEmail = $this->getLastEmail();
$this->assertStringNotContainsString('<html>test</html>', $lastEmail['html']);
/**
* Magic URL
*/
$response = $this->client->call(Client::METHOD_POST, '/account/sessions/magic-url', array_merge([
'origin' => 'http://localhost',
'content-type' => 'application/json',
'x-appwrite-project' => $this->getProject()['$id'],
]), [
'userId' => $account['id'],
'email' => $email
]);
$this->assertEquals(201, $response['headers']['status-code']);
$lastEmail = $this->getLastEmail();
$this->assertStringNotContainsString('<html>test</html>', $lastEmail['html']);
}
}
tests/e2e/Services/Teams/TeamsBase.php
-1
View File
@@ -3,7 +3,6 @@
namespace Tests\E2E\Services\Teams;
use Tests\E2E\Client;
use Utopia\Database\DateTime;
use Utopia\Database\Helpers\ID;
use Utopia\Database\Validator\Datetime as DatetimeValidator;
tests/e2e/Services/Teams/TeamsBaseClient.php
-1
View File
@@ -3,7 +3,6 @@
namespace Tests\E2E\Services\Teams;
use Tests\E2E\Client;
use Utopia\Database\DateTime;
use Utopia\Database\Helpers\ID;
use Utopia\Database\Validator\Datetime as DatetimeValidator;