mirror of
https://github.com/HolgerHatGarKeineNode/einundzwanzig-app.git
synced 2026-06-11 02:50:29 +00:00
HolgerHatGarKeineNode
3cad5f5636
- 🛠️ Refactored controllers to utilize `FiltersNumericIds` concern, ensuring secure numeric ID filtering and avoiding type-sensitive errors in queries. - ➕ Added feature tests to validate robust input hardening for non-numeric or malformed query parameters (`user_id`, `selected[]`). - 🔒 Introduced `PublicPropertyNotFoundException` handling in Livewire, returning 400 for invalid property probes and suppressing unnecessary log entries. - ❌ Updated `MeetupEventController` to handle invalid date formats gracefully, aborting with a 400 response instead of 500. - ✅ Expanded exception handling pipeline for enhanced resilience against malformed input, bot noise, and exploitable probes.
83 lines
2.8 KiB
PHP
83 lines
2.8 KiB
PHP
<?php
|
|
|
|
use Illuminate\Support\Facades\Log;
|
|
use Illuminate\Support\Facades\Route;
|
|
use Livewire\Exceptions\MethodNotFoundException;
|
|
use Livewire\Exceptions\PublicPropertyNotFoundException;
|
|
use Livewire\Features\SupportLifecycleHooks\DirectlyCallingLifecycleHooksNotAllowedException;
|
|
use Livewire\Mechanisms\HandleComponents\CorruptComponentPayloadException;
|
|
|
|
it('returns 400 for lifecycle-hook probing instead of 500', function () {
|
|
Route::get('/_test/livewire-lifecycle-probe', function () {
|
|
throw new DirectlyCallingLifecycleHooksNotAllowedException('dehydrate', 'auth.login');
|
|
});
|
|
|
|
expect($this->get('/_test/livewire-lifecycle-probe')->status())->toBe(400);
|
|
});
|
|
|
|
it('returns 400 for magic-method probing instead of 500', function () {
|
|
Route::get('/_test/livewire-magic-method-probe', function () {
|
|
throw new MethodNotFoundException('__call');
|
|
});
|
|
|
|
expect($this->get('/_test/livewire-magic-method-probe')->status())->toBe(400);
|
|
});
|
|
|
|
it('does not report Livewire exploit probes to the logs', function () {
|
|
Log::spy();
|
|
|
|
Route::get('/_test/livewire-probe-log', function () {
|
|
throw new DirectlyCallingLifecycleHooksNotAllowedException('dehydrate', 'auth.login');
|
|
});
|
|
|
|
$this->get('/_test/livewire-probe-log')->assertStatus(400);
|
|
|
|
Log::shouldNotHaveReceived('error');
|
|
Log::shouldNotHaveReceived('critical');
|
|
Log::shouldNotHaveReceived('emergency');
|
|
});
|
|
|
|
it('still surfaces genuine method-not-found bugs', function () {
|
|
Route::get('/_test/livewire-real-method-not-found', function () {
|
|
throw new MethodNotFoundException('saveProfile');
|
|
});
|
|
|
|
expect($this->get('/_test/livewire-real-method-not-found')->status())->not->toBe(400);
|
|
});
|
|
|
|
it('returns 400 for setting an undeclared public property instead of 500', function () {
|
|
Route::get('/_test/livewire-undeclared-property', function () {
|
|
throw new PublicPropertyNotFoundException('value', 'welcome');
|
|
});
|
|
|
|
expect($this->get('/_test/livewire-undeclared-property')->status())->toBe(400);
|
|
});
|
|
|
|
it('does not report undeclared-property probes to the logs', function () {
|
|
Log::spy();
|
|
|
|
Route::get('/_test/livewire-undeclared-property-log', function () {
|
|
throw new PublicPropertyNotFoundException('value', 'welcome');
|
|
});
|
|
|
|
$this->get('/_test/livewire-undeclared-property-log')->assertStatus(400);
|
|
|
|
Log::shouldNotHaveReceived('error');
|
|
Log::shouldNotHaveReceived('critical');
|
|
Log::shouldNotHaveReceived('emergency');
|
|
});
|
|
|
|
it('does not report corrupt Livewire snapshot payloads', function () {
|
|
Log::spy();
|
|
|
|
Route::get('/_test/livewire-corrupt-payload', function () {
|
|
throw new CorruptComponentPayloadException;
|
|
});
|
|
|
|
$this->get('/_test/livewire-corrupt-payload');
|
|
|
|
Log::shouldNotHaveReceived('error');
|
|
Log::shouldNotHaveReceived('critical');
|
|
Log::shouldNotHaveReceived('emergency');
|
|
});
|