diff --git a/tests/e2e/Services/Account/AccountBase.php b/tests/e2e/Services/Account/AccountBase.php index e6f5feaa84..6b931e2151 100644 --- a/tests/e2e/Services/Account/AccountBase.php +++ b/tests/e2e/Services/Account/AccountBase.php @@ -10,11 +10,9 @@ use Utopia\Database\Validator\Datetime as DatetimeValidator; trait AccountBase { - public function testCreateAccount(): array + public function testCreateAccount($name = 'User Name', $password = 'password', $email = null): array { - $email = uniqid() . 'user@localhost.test'; - $password = 'password'; - $name = 'User Name'; + $email ??= uniqid() . 'user@localhost.test'; /** * Test for SUCCESS @@ -1554,4 +1552,63 @@ trait AccountBase return $data; } + + public function testAccountEmailInjections() + { + $account = $this->testCreateAccount(name: 'test'); + $data = $this->testCreateAccountSession($account); + [ + 'session' => $session, + 'email' => $email + ] = $data; + + /** + * Verification + */ + $response = $this->client->call(Client::METHOD_POST, '/account/verification', array_merge([ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'cookie' => 'a_session_' . $this->getProject()['$id'] . '=' . $session, + + ]), [ + 'url' => 'http://localhost/verification', + ]); + + $this->assertEquals(201, $response['headers']['status-code']); + $lastEmail = $this->getLastEmail(); + $this->assertStringNotContainsString('test', $lastEmail['html']); + + /** + * Recovery + */ + $response = $this->client->call(Client::METHOD_POST, '/account/recovery', array_merge([ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ]), [ + 'email' => $email, + 'url' => 'http://localhost/recovery', + ]); + + $this->assertEquals(201, $response['headers']['status-code']); + $lastEmail = $this->getLastEmail(); + $this->assertStringNotContainsString('test', $lastEmail['html']); + + /** + * Magic URL + */ + $response = $this->client->call(Client::METHOD_POST, '/account/sessions/magic-url', array_merge([ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ]), [ + 'userId' => $account['id'], + 'email' => $email + ]); + + $this->assertEquals(201, $response['headers']['status-code']); + $lastEmail = $this->getLastEmail(); + $this->assertStringNotContainsString('test', $lastEmail['html']); + } } diff --git a/tests/e2e/Services/Teams/TeamsBase.php b/tests/e2e/Services/Teams/TeamsBase.php index 83b9042f13..87034964f4 100644 --- a/tests/e2e/Services/Teams/TeamsBase.php +++ b/tests/e2e/Services/Teams/TeamsBase.php @@ -3,7 +3,6 @@ namespace Tests\E2E\Services\Teams; use Tests\E2E\Client; -use Utopia\Database\DateTime; use Utopia\Database\Helpers\ID; use Utopia\Database\Validator\Datetime as DatetimeValidator; diff --git a/tests/e2e/Services/Teams/TeamsBaseClient.php b/tests/e2e/Services/Teams/TeamsBaseClient.php index 2c2ff02c41..3f0e983b42 100644 --- a/tests/e2e/Services/Teams/TeamsBaseClient.php +++ b/tests/e2e/Services/Teams/TeamsBaseClient.php @@ -3,7 +3,6 @@ namespace Tests\E2E\Services\Teams; use Tests\E2E\Client; -use Utopia\Database\DateTime; use Utopia\Database\Helpers\ID; use Utopia\Database\Validator\Datetime as DatetimeValidator;