mirror of https://github.com/pixelfed/pixelfed
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
64 lines
2.2 KiB
PHP
64 lines
2.2 KiB
PHP
<?php
|
|
|
|
use App\Jobs\StoryPipeline\StoryFetch;
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| StoryFetch::validateDomainConsistency prefix normalization
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| The check used ltrim($host, 'www.'), which strips a leading run of any of
|
|
| the characters w/., not the literal "www." prefix. So wwworld.victim.com
|
|
| collapsed to orld.victim.com and falsely matched a different domain,
|
|
| bypassing the same-domain federation guard. Only a real "www." prefix must
|
|
| be normalized.
|
|
|
|
|
*/
|
|
|
|
function callValidateDomainConsistency(string $url1, string $url2): bool
|
|
{
|
|
$job = new StoryFetch([]);
|
|
$ref = new ReflectionMethod($job, 'validateDomainConsistency');
|
|
$ref->setAccessible(true);
|
|
|
|
return $ref->invoke($job, $url1, $url2);
|
|
}
|
|
|
|
it('does not let a wwworld host match a different domain', function () {
|
|
expect(callValidateDomainConsistency(
|
|
'https://wwworld.victim.com/story/123',
|
|
'https://orld.victim.com/users/alice',
|
|
))->toBeFalse();
|
|
});
|
|
|
|
it('does not treat leading w/. runs as a www prefix', function () {
|
|
expect(callValidateDomainConsistency('https://w.example.com/a', 'https://example.com/b'))->toBeFalse();
|
|
expect(callValidateDomainConsistency('https://ww.example.com/a', 'https://example.com/b'))->toBeFalse();
|
|
expect(callValidateDomainConsistency('https://wwww.example.com/a', 'https://example.com/b'))->toBeFalse();
|
|
});
|
|
|
|
it('matches identical hosts', function () {
|
|
expect(callValidateDomainConsistency(
|
|
'https://example.com/story/1',
|
|
'https://example.com/users/bob',
|
|
))->toBeTrue();
|
|
});
|
|
|
|
it('is case-insensitive', function () {
|
|
expect(callValidateDomainConsistency(
|
|
'https://Example.COM/story/1',
|
|
'https://example.com/users/bob',
|
|
))->toBeTrue();
|
|
});
|
|
|
|
it('normalizes a genuine www. prefix on one side', function () {
|
|
expect(callValidateDomainConsistency(
|
|
'https://www.example.com/story/1',
|
|
'https://example.com/users/bob',
|
|
))->toBeTrue();
|
|
});
|
|
|
|
it('returns false when a host cannot be parsed', function () {
|
|
expect(callValidateDomainConsistency('not a url', 'https://example.com/x'))->toBeFalse();
|
|
});
|