Prevent PHP errors using more strict filters

Arachne · Sep 10, 2016 · f5f8171 · f5f8171
1 parent 00bd689
commit f5f8171
Show file tree

Hide file tree

Showing 9 changed files with 162 additions and 26 deletions.
diff --git a/src/FilterIn/BooleanFilterIn.php b/src/FilterIn/BooleanFilterIn.php
@@ -11,6 +11,7 @@
 namespace Arachne\EntityLoader\FilterIn;
 
 use Arachne\EntityLoader\FilterInInterface;
+use Nette\Application\BadRequestException;
 
 /**
  * @author Jáchym Toušek <enumag@gmail.com>
@@ -22,6 +23,10 @@ class BooleanFilterIn implements FilterInInterface
      */
     public function filterIn($value)
     {
+        if (!is_string($value)) {
+            throw new BadRequestException();
+        }
+
         return (bool) $value;
     }
 }
diff --git a/src/FilterIn/FloatFilterIn.php b/src/FilterIn/FloatFilterIn.php
@@ -11,6 +11,7 @@
 namespace Arachne\EntityLoader\FilterIn;
 
 use Arachne\EntityLoader\FilterInInterface;
+use Nette\Application\BadRequestException;
 
 /**
  * @author Jáchym Toušek <enumag@gmail.com>
@@ -22,6 +23,10 @@ class FloatFilterIn implements FilterInInterface
      */
     public function filterIn($value)
     {
+        if (!is_string($value)) {
+            throw new BadRequestException();
+        }
+
         return (float) $value;
     }
 }
diff --git a/src/FilterIn/IntegerFilterIn.php b/src/FilterIn/IntegerFilterIn.php
@@ -11,6 +11,7 @@
 namespace Arachne\EntityLoader\FilterIn;
 
 use Arachne\EntityLoader\FilterInInterface;
+use Nette\Application\BadRequestException;
 
 /**
  * @author Jáchym Toušek <enumag@gmail.com>
@@ -22,6 +23,10 @@ class IntegerFilterIn implements FilterInInterface
      */
     public function filterIn($value)
     {
+        if (!is_string($value)) {
+            throw new BadRequestException();
+        }
+
         return (int) $value;
     }
 }
diff --git a/src/FilterIn/StringFilterIn.php b/src/FilterIn/StringFilterIn.php
@@ -11,6 +11,7 @@
 namespace Arachne\EntityLoader\FilterIn;
 
 use Arachne\EntityLoader\FilterInInterface;
+use Nette\Application\BadRequestException;
 
 /**
  * @author Jáchym Toušek <enumag@gmail.com>
@@ -22,6 +23,10 @@ class StringFilterIn implements FilterInInterface
      */
     public function filterIn($value)
     {
-        return (string) $value;
+        if (!is_string($value)) {
+            throw new BadRequestException();
+        }
+
+        return $value;
     }
 }
diff --git a/tests/functional/config/config.neon b/tests/functional/config/config.neon
@@ -11,7 +11,7 @@ extensions:
     oops.cachefactory: Oops\CacheFactory\DI\CacheFactoryExtension
 
 nette.application:
-    catchExceptions: null
+    catchExceptions: false
     mapping:
         *: Tests\Functional\Fixtures\*Presenter
 

diff --git a/tests/functional/src/Fixtures/ArticlePresenter.php b/tests/functional/src/Fixtures/ArticlePresenter.php
@@ -18,14 +18,35 @@ public function actionUntyped($parameter)
     {
     }
 
+    public function actionEntity(Article $parameter)
+    {
+    }
+
     /**
      * @param int $parameter
      */
     public function actionInt($parameter = 1)
     {
     }
 
-    public function actionEntity(Article $parameter)
+    /**
+     * @param bool $parameter
+     */
+    public function actionBool($parameter)
+    {
+    }
+
+    /**
+     * @param float $parameter
+     */
+    public function actionFloat($parameter)
+    {
+    }
+
+    /**
+     * @param string $parameter
+     */
+    public function actionString($parameter)
     {
     }
 }
diff --git a/tests/functional/src/Fixtures/RouterFactory.php b/tests/functional/src/Fixtures/RouterFactory.php
@@ -29,9 +29,12 @@ public function __construct(RequestEntityUnloader $unloader)
     public function create()
     {
         $router = new RouteList();
-        $router[] = new Route('/<action>[/<parameter>]', [
-            'presenter' => 'Article',
-        ]);
+        $router[] = new Route(
+            '/<action>',
+            [
+                'presenter' => 'Article',
+            ]
+        );
 
         return new RouterWrapper($router, $this->unloader);
     }

diff --git a/tests/functional/src/RequestEntityLoaderTest.php b/tests/functional/src/RequestEntityLoaderTest.php
@@ -4,6 +4,7 @@
 
 use Codeception\TestCase\Test;
 use Nette\Application\Application;
+use Nette\Application\UI\Presenter;
 use Tests\Functional\Fixtures\Article;
 
 /**
@@ -17,36 +18,127 @@ class RequestEntityLoaderTest extends Test
      */
     public function testUntyped()
     {
-        $this->tester->amOnPage('/untyped/5');
+        $this->tester->amOnPage('/untyped?parameter=5');
+    }
+
+    public function testEntity()
+    {
+        $this->tester->amOnPage('/entity?parameter=5');
+        $presenter = $this->tester->grabService(Application::class)->getPresenter();
+        self::assertInstanceOf(Presenter::class, $presenter);
+        $request = $presenter->getRequest();
+        self::assertEquals(
+            [
+                'action' => 'entity',
+                'parameter' => new Article(5),
+            ],
+            $request->getParameters()
+        );
     }
 
     public function testInt()
     {
-        $this->tester->amOnPage('/int/5');
-        $request = $this->tester->grabService(Application::class)->getPresenter()->getRequest();
-        $this->assertSame([
-            'action' => 'int',
-            'parameter' => 5,
-        ], $request->getParameters());
+        $this->tester->amOnPage('/int?parameter=5');
+        $presenter = $this->tester->grabService(Application::class)->getPresenter();
+        self::assertInstanceOf(Presenter::class, $presenter);
+        $request = $presenter->getRequest();
+        self::assertSame(
+            [
+                'action' => 'int',
+                'parameter' => 5,
+            ],
+            $request->getParameters()
+        );
     }
 
     public function testIntWithDefault()
     {
         $this->tester->amOnPage('/int');
-        $request = $this->tester->grabService(Application::class)->getPresenter()->getRequest();
-        $this->assertSame([
-            'action' => 'int',
-            'parameter' => null,
-        ], $request->getParameters());
+        $presenter = $this->tester->grabService(Application::class)->getPresenter();
+        self::assertInstanceOf(Presenter::class, $presenter);
+        $request = $presenter->getRequest();
+        self::assertSame(
+            [
+                'action' => 'int',
+            ],
+            $request->getParameters()
+        );
     }
 
-    public function testEntity()
+    /**
+     * @expectedException Nette\Application\BadRequestException
+     */
+    public function testIntError()
+    {
+        $this->tester->amOnPage('/int?parameter[]=0');
+    }
+
+    public function testBool()
+    {
+        $this->tester->amOnPage('/bool?parameter=1');
+        $presenter = $this->tester->grabService(Application::class)->getPresenter();
+        self::assertInstanceOf(Presenter::class, $presenter);
+        $request = $presenter->getRequest();
+        self::assertSame(
+            [
+                'action' => 'bool',
+                'parameter' => true,
+            ],
+            $request->getParameters()
+        );
+    }
+
+    /**
+     * @expectedException Nette\Application\BadRequestException
+     */
+    public function testBoolError()
+    {
+        $this->tester->amOnPage('/bool?parameter[]=0');
+    }
+
+    public function testFloat()
+    {
+        $this->tester->amOnPage('/float?parameter=1');
+        $presenter = $this->tester->grabService(Application::class)->getPresenter();
+        self::assertInstanceOf(Presenter::class, $presenter);
+        $request = $presenter->getRequest();
+        self::assertSame(
+            [
+                'action' => 'float',
+                'parameter' => 1.0,
+            ],
+            $request->getParameters()
+        );
+    }
+
+    /**
+     * @expectedException Nette\Application\BadRequestException
+     */
+    public function testFloatError()
+    {
+        $this->tester->amOnPage('/float?parameter[]=0');
+    }
+
+    public function testString()
+    {
+        $this->tester->amOnPage('/string?parameter=1');
+        $presenter = $this->tester->grabService(Application::class)->getPresenter();
+        self::assertInstanceOf(Presenter::class, $presenter);
+        $request = $presenter->getRequest();
+        self::assertSame(
+            [
+                'action' => 'string',
+                'parameter' => '1',
+            ],
+            $request->getParameters()
+        );
+    }
+
+    /**
+     * @expectedException Nette\Application\BadRequestException
+     */
+    public function testStringError()
     {
-        $this->tester->amOnPage('/entity/5');
-        $request = $this->tester->grabService(Application::class)->getPresenter()->getRequest();
-        $this->assertEquals([
-            'action' => 'entity',
-            'parameter' => new Article(5),
-        ], $request->getParameters());
+        $this->tester->amOnPage('/string?parameter[]=0');
     }
 }
diff --git a/tests/functional/src/RequestEntityUnloaderTest.php b/tests/functional/src/RequestEntityUnloaderTest.php
@@ -15,6 +15,6 @@ public function testLink()
     {
         $this->tester->amOnPage('/default');
         $presenter = $this->tester->grabService(Application::class)->getPresenter();
-        $this->assertSame('/entity/5', $presenter->link('Article:entity', new Article(5)));
+        $this->assertSame('/entity?parameter=5', $presenter->link('Article:entity', new Article(5)));
     }
 }