mirror/Arsse
1
1
Fork 0
mirror of https://code.mensbeam.com/MensBeam/Arsse.git synced 2024-12-22 13:12:41 +00:00
Code Issues Activity

Make media type checking more robust

Browse source
This commit is contained in:
J. King 2019-09-27 22:38:03 -04:00
parent 5f993187ea
commit 4f5a8e3180
6 changed files with 67 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
lib/Misc/HTTP.php Normal file
View file

@ -0,0 +1,22 @@
<?php
/** @license MIT
* Copyright 2017 J. King, Dustin Wilson et al.
* See LICENSE and AUTHORS files for details */
declare(strict_types=1);
namespace JKingWeb\Arsse\Misc;
use Psr\Http\Message\MessageInterface;
class HTTP {
public static function matchType(MessageInterface $msg, string ...$type): bool {
$header = $msg->getHeaderLine("Content-Type") ?? "";
foreach ($type as $t) {
$pattern = "/^".preg_quote(trim($t), "/")."($|;|,)/i";
if (preg_match($pattern, $header)) {
return true;
}
}
return false;
}
}

8
lib/REST/Fever/API.php
View file

@ -11,6 +11,7 @@ use JKingWeb\Arsse\Context\Context;
use JKingWeb\Arsse\Misc\ValueInfo as V;
use JKingWeb\Arsse\Misc\Date;
use JKingWeb\Arsse\Db\ExceptionInput;
use JKingWeb\Arsse\Misc\HTTP;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Message\ResponseInterface;
use Zend\Diactoros\Response\JsonResponse;
@ -21,6 +22,7 @@ class API extends \JKingWeb\Arsse\REST\AbstractHandler {
const LEVEL = 3;
const GENERIC_ICON_TYPE = "image/png;base64";
const GENERIC_ICON_DATA = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAAZdEVYdFNvZnR3YXJlAHBhaW50Lm5ldCA0LjAuMjHxIGmVAAAADUlEQVQYV2NgYGBgAAAABQABijPjAAAAAABJRU5ErkJggg==";
const ACCEPTED_TYPE = "application/x-www-form-urlencoded";
// GET parameters for which we only check presence: these will be converted to booleans
const PARAM_BOOL = ["groups", "feeds", "items", "favicons", "links", "unread_item_ids", "saved_item_ids"];
@ -66,11 +68,11 @@ class API extends \JKingWeb\Arsse\REST\AbstractHandler {
case "OPTIONS":
return new EmptyResponse(204, [
'Allow' => "POST",
'Accept' => "application/x-www-form-urlencoded",
'Accept' => self::ACCEPTED_TYPE,
]);
case "POST":
if (strlen($req->getHeaderLine("Content-Type")) && $req->getHeaderLine("Content-Type") !== "application/x-www-form-urlencoded") {
return new EmptyResponse(415, ['Accept' => "application/x-www-form-urlencoded"]);
if (!HTTP::matchType($req, self::ACCEPTED_TYPE, "")) {
return new EmptyResponse(415, ['Accept' => self::ACCEPTED_TYPE]);
}
$out = [
'api_version' => self::LEVEL,

13
lib/REST/NextCloudNews/V1_2.php
View file

@ -13,6 +13,7 @@ use JKingWeb\Arsse\Misc\ValueInfo;
use JKingWeb\Arsse\AbstractException;
use JKingWeb\Arsse\Db\ExceptionInput;
use JKingWeb\Arsse\Feed\Exception as FeedException;
use JKingWeb\Arsse\Misc\HTTP;
use JKingWeb\Arsse\REST\Exception404;
use JKingWeb\Arsse\REST\Exception405;
use Psr\Http\Message\ServerRequestInterface;
@ -23,6 +24,7 @@ use Zend\Diactoros\Response\EmptyResponse;
class V1_2 extends \JKingWeb\Arsse\REST\AbstractHandler {
const REALM = "NextCloud News API v1-2";
const VERSION = "11.0.5";
const ACCEPTED_TYPE = "application/json";
protected $dateFormat = "unix";
@ -90,15 +92,10 @@ class V1_2 extends \JKingWeb\Arsse\REST\AbstractHandler {
}
// normalize the input
$data = (string) $req->getBody();
$type = "";
if ($req->hasHeader("Content-Type")) {
$type = $req->getHeader("Content-Type");
$type = array_pop($type);
}
if ($data) {
// if the entity body is not JSON according to content type, return "415 Unsupported Media Type"
if (!preg_match("<^application/json\b|^$>", $type)) {
return new EmptyResponse(415, ['Accept' => "application/json"]);
if (!HTTP::matchType($req, "", self::ACCEPTED_TYPE)) {
return new EmptyResponse(415, ['Accept' => self::ACCEPTED_TYPE]);
}
$data = @json_decode($data, true);
if (json_last_error() !== \JSON_ERROR_NONE) {
@ -269,7 +266,7 @@ class V1_2 extends \JKingWeb\Arsse\REST\AbstractHandler {
}
return new EmptyResponse(204, [
'Allow' => implode(",", $allowed),
'Accept' => "application/json",
'Accept' => self::ACCEPTED_TYPE,
]);
} else {
// if the path is not supported, return 404

3
lib/REST/TinyTinyRSS/API.php
View file

@ -43,6 +43,7 @@ class API extends \JKingWeb\Arsse\REST\AbstractHandler {
const CAT_NOT_SPECIAL = -3;
const CAT_ALL = -4;
// valid input
const ACCEPTED_TYPES = ["application/json", "text/json"];
const VALID_INPUT = [
'op' => ValueInfo::T_STRING, // the function ("operation") to perform
'sid' => ValueInfo::T_STRING, // session ID
@ -99,7 +100,7 @@ class API extends \JKingWeb\Arsse\REST\AbstractHandler {
// respond to OPTIONS rquests; the response is a fib, as we technically accept any type or method
return new EmptyResponse(204, [
'Allow' => "POST",
'Accept' => "application/json, text/json",
'Accept' => implode(", ", self::ACCEPTED_TYPES),
]);
}
$data = (string) $req->getBody();

32
tests/cases/Misc/TestHTTP.php Normal file
View file

@ -0,0 +1,32 @@
<?php
/** @license MIT
* Copyright 2017 J. King, Dustin Wilson et al.
* See LICENSE and AUTHORS files for details */
declare(strict_types=1);
namespace JKingWeb\Arsse\TestCase\Misc;
use JKingWeb\Arsse\Misc\HTTP;
use Psr\Http\Message\ResponseInterface;
/** @covers \JKingWeb\Arsse\Misc\HTTP */
class TestHTTP extends \JKingWeb\Arsse\Test\AbstractTest {
/** @dataProvider provideMediaTypes */
public function testMatchMediaType(string $header, array $types, bool $exp) {
$msg = (new \Zend\Diactoros\Request)->withHeader("Content-Type", $header);
$this->assertSame($exp, HTTP::matchType($msg, ...$types));
$msg = (new \Zend\Diactoros\Response)->withHeader("Content-Type", $header);
$this->assertSame($exp, HTTP::matchType($msg, ...$types));
}
public function provideMediaTypes() {
return [
["application/json", ["application/json"], true],
["APPLICATION/JSON", ["application/json"], true],
["text/JSON", ["application/json", "text/json"], true],
["text/json; charset=utf-8", ["application/json", "text/json"], true],
["", ["application/json"], false],
["", ["application/json", ""], true],
];
}
}

1
tests/phpunit.dist.xml
View file

@ -47,6 +47,7 @@
<file>cases/Misc/TestDate.php</file>
<file>cases/Misc/TestContext.php</file>
<file>cases/Misc/TestURL.php</file>
<file>cases/Misc/TestHTTP.php</file>
</testsuite>
<testsuite name="User management">
<file>cases/User/TestInternal.php</file>