mirror of
https://github.com/HolgerHatGarKeineNode/einundzwanzig-app.git
synced 2026-06-03 12:45:36 +00:00
🐛 **Handle Livewire exploit probes gracefully**
- ✅ Added detection for Livewire exploit probes (`DirectlyCallingLifecycleHooksNotAllowedException` and magic method `MethodNotFoundException`) to prevent 500 errors. - 🛠️ Updated exception handling to return a 400 response for probe requests. - 🔇 Suppressed logging of exploit probe exceptions to reduce noise. - ✅ Added tests to verify 400 responses, logging suppression, and correct handling of legitimate exceptions.
This commit is contained in:
@@ -0,0 +1,44 @@
|
||||
<?php
|
||||
|
||||
use Illuminate\Support\Facades\Log;
|
||||
use Illuminate\Support\Facades\Route;
|
||||
use Livewire\Exceptions\MethodNotFoundException;
|
||||
use Livewire\Features\SupportLifecycleHooks\DirectlyCallingLifecycleHooksNotAllowedException;
|
||||
|
||||
it('returns 400 for lifecycle-hook probing instead of 500', function () {
|
||||
Route::get('/_test/livewire-lifecycle-probe', function () {
|
||||
throw new DirectlyCallingLifecycleHooksNotAllowedException('dehydrate', 'auth.login');
|
||||
});
|
||||
|
||||
expect($this->get('/_test/livewire-lifecycle-probe')->status())->toBe(400);
|
||||
});
|
||||
|
||||
it('returns 400 for magic-method probing instead of 500', function () {
|
||||
Route::get('/_test/livewire-magic-method-probe', function () {
|
||||
throw new MethodNotFoundException('__call');
|
||||
});
|
||||
|
||||
expect($this->get('/_test/livewire-magic-method-probe')->status())->toBe(400);
|
||||
});
|
||||
|
||||
it('does not report Livewire exploit probes to the logs', function () {
|
||||
Log::spy();
|
||||
|
||||
Route::get('/_test/livewire-probe-log', function () {
|
||||
throw new DirectlyCallingLifecycleHooksNotAllowedException('dehydrate', 'auth.login');
|
||||
});
|
||||
|
||||
$this->get('/_test/livewire-probe-log')->assertStatus(400);
|
||||
|
||||
Log::shouldNotHaveReceived('error');
|
||||
Log::shouldNotHaveReceived('critical');
|
||||
Log::shouldNotHaveReceived('emergency');
|
||||
});
|
||||
|
||||
it('still surfaces genuine method-not-found bugs', function () {
|
||||
Route::get('/_test/livewire-real-method-not-found', function () {
|
||||
throw new MethodNotFoundException('saveProfile');
|
||||
});
|
||||
|
||||
expect($this->get('/_test/livewire-real-method-not-found')->status())->not->toBe(400);
|
||||
});
|
||||
Reference in New Issue
Block a user