Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: use assertEmpty for impersonatorUserId to match response model

Browse Source
This commit is contained in:
harsh mahajan
2026-04-28 14:31:49 +05:30
parent bda823ac0e
commit f0cbfbbbe4
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/e2e/Services/Users/UsersBase.php
+4 -4
View File
@@ -2778,7 +2778,7 @@ trait UsersBase
);
$this->assertEquals(200, $crossSite['headers']['status-code']);
$this->assertEquals($impersonatorId, $crossSite['body']['$id'], 'cross-site: impersonation must be blocked');
$this->assertArrayNotHasKey('impersonatorUserId', $crossSite['body']);
$this->assertEmpty($crossSite['body']['impersonatorUserId'] ?? '');
// Attack vector 2: absent header (reverse proxy strips Fetch Metadata headers)
// Guard must fail-closed — absent Sec-Fetch-Site must not allow query param.
@@ -2790,7 +2790,7 @@ trait UsersBase
);
$this->assertEquals(200, $noFetchSite['headers']['status-code']);
$this->assertEquals($impersonatorId, $noFetchSite['body']['$id'], 'absent header: must fail-closed');
$this->assertArrayNotHasKey('impersonatorUserId', $noFetchSite['body']);
$this->assertEmpty($noFetchSite['body']['impersonatorUserId'] ?? '');
// Legitimate use 1: same-origin (Console on same origin as API)
$sameOrigin = $this->client->call(
@@ -2915,7 +2915,7 @@ trait UsersBase
$this->assertEquals(200, $account['headers']['status-code']);
// Should resolve as userA (the impersonator), not the target
$this->assertEquals($idA, $account['body']['$id']);
$this->assertArrayNotHasKey('impersonatorUserId', $account['body']);
$this->assertEmpty($account['body']['impersonatorUserId'] ?? '');
}
/**
@@ -2965,7 +2965,7 @@ trait UsersBase
], ['impersonateUserId' => $idB]);
$this->assertEquals(200, $account['headers']['status-code']);
$this->assertEquals($idA, $account['body']['$id']);
$this->assertArrayNotHasKey('impersonatorUserId', $account['body']);
$this->assertEmpty($account['body']['impersonatorUserId'] ?? '');
}
/**