1, 'csrf' => 'test-csrf'];
}
protected function tearDown(): void
{
unset($_SESSION);
}
public function testConnectionDetailsNeverRedisplaySecrets(): void
{
$resp = Views::connect(
['id' => 1, 'username' => 'admin'],
[
[
'access_key_id' => 'AKIATESTKEY0001',
'description' => 'laptop-rclone',
'secret_access_key' => 'wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY',
],
],
['photos', 'backups'],
'https://s3.example.com',
'eu-west-1',
);
self::assertSame(200, $resp->status);
self::assertSame('no-store', $resp->headers['Cache-Control'] ?? '');
foreach ([
'https://s3.example.com',
'eu-west-1',
'AKIATESTKEY0001',
'laptop-rclone',
'photos',
'backups',
'data-copy="f-endpoint"',
'data-copy="f-region"',
'data-copy="f-bucket"',
'data-copy="f-akid"',
'f-keyselect',
] as $needle) {
self::assertStringContainsString($needle, $resp->body);
}
self::assertStringNotContainsString('wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY', $resp->body);
self::assertStringContainsString('never redisplays a secret', $resp->body);
}
public function testEmptyStateStillRendersEndpointAndRegion(): void
{
$resp = Views::connect(
['id' => 1, 'username' => 'admin'],
[],
[],
'http://127.0.0.1:8099',
'us-east-1',
);
self::assertSame(200, $resp->status);
self::assertStringContainsString('No keys yet', $resp->body);
self::assertStringContainsString('* (all buckets)', $resp->body);
self::assertStringContainsString('http://127.0.0.1:8099', $resp->body);
self::assertStringContainsString('us-east-1', $resp->body);
}
public function testUserSuppliedStringsAreHtmlEscaped(): void
{
$xss = '';
$resp = Views::connect(
['id' => 1, 'username' => 'admin'],
[['access_key_id' => 'AKIA"EVIL', 'description' => $xss, 'secret_access_key' => 's']],
['
'],
'https://s3.example.com',
'us-east-1',
);
self::assertStringNotContainsString($xss, $resp->body);
self::assertStringContainsString('<script>alert(1)</script>', $resp->body);
self::assertStringNotContainsString('', $resp->body);
self::assertStringNotContainsString('value="AKIA"EVIL"', $resp->body);
self::assertStringNotContainsString('s', $resp->body);
self::assertStringNotContainsString('<b>s</b>', $resp->body);
}
}