mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-12 15:53:46 -04:00
Andras BacsaiandClaude Opus 5.5
a70e856882
- Remove tests that only check markup, CSS, static text, wire:key strings, framework behavior, copied app logic, or expect(true) - Replace source-grep and Reflection checks of security fixes with tests that run the real code (shell quoting, locked properties, 403 checks, webhook fork trust, log redaction, Sentinel token cleanup) - Assert response bodies and unchanged data on API error paths - Run the Traefik version job through handle() instead of private methods - Update stale tests for scheduled task props, the default Postgres image, and the disabled transfer link of unvalidated servers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
72 lines
2.6 KiB
PHP
72 lines
2.6 KiB
PHP
<?php
|
|
|
|
use App\Enums\ApplicationDeploymentStatus;
|
|
use App\Models\Application;
|
|
use App\Models\ApplicationDeploymentQueue;
|
|
use App\Models\Environment;
|
|
use App\Models\InstanceSettings;
|
|
use App\Models\Project;
|
|
use App\Models\Server;
|
|
use App\Models\StandaloneDocker;
|
|
use App\Models\Team;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
beforeEach(function () {
|
|
InstanceSettings::forceCreate(['id' => 0]);
|
|
|
|
$user = User::factory()->create();
|
|
$team = Team::factory()->create();
|
|
$team->members()->attach($user->id, ['role' => 'owner']);
|
|
$this->actingAs($user);
|
|
session(['currentTeam' => $team]);
|
|
|
|
$server = Server::factory()->create(['team_id' => $team->id]);
|
|
$destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
|
|
$this->project = Project::factory()->create(['team_id' => $team->id]);
|
|
$this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
|
|
$this->application = Application::factory()->create([
|
|
'environment_id' => $this->environment->id,
|
|
'destination_id' => $destination->id,
|
|
'destination_type' => $destination->getMorphClass(),
|
|
]);
|
|
$this->deployment = ApplicationDeploymentQueue::create([
|
|
'application_id' => $this->application->id,
|
|
'deployment_uuid' => 'deploy-html-escape-test',
|
|
'server_id' => $server->id,
|
|
'status' => ApplicationDeploymentStatus::FINISHED->value,
|
|
'logs' => json_encode([[
|
|
'command' => null,
|
|
'output' => '"><img src=x onerror=alert(1)>',
|
|
'type' => 'stdout',
|
|
'timestamp' => now()->toISOString(),
|
|
'hidden' => false,
|
|
'batch' => 1,
|
|
'order' => 1,
|
|
]], JSON_THROW_ON_ERROR),
|
|
]);
|
|
});
|
|
|
|
it('escapes deployment log lines exactly once in the log viewer', function () {
|
|
$response = $this->get(route('project.application.deployment.show', [
|
|
'project_uuid' => $this->project->uuid,
|
|
'environment_uuid' => $this->environment->uuid,
|
|
'application_uuid' => $this->application->uuid,
|
|
'deployment_uuid' => $this->deployment->deployment_uuid,
|
|
]));
|
|
|
|
$escaped = '"><img src=x onerror=alert(1)>';
|
|
|
|
$response->assertSuccessful();
|
|
$html = $response->getContent();
|
|
|
|
expect($html)
|
|
->toContain('data-line-text="'.$escaped.'"')
|
|
->toContain('>'.$escaped.'</span>')
|
|
->toMatch('/data-log-content="[^"]* '.preg_quote($escaped, '/').'"/')
|
|
->not->toContain('<img src=x onerror=alert(1)>')
|
|
->not->toContain('&quot;&gt;&lt;img');
|
|
});
|