128debb64b
Follows-up I361fde0de7f4406bce6ed075ed397effa5be3359. Per T253461, not mass-changing source code, but the use of the native error silencing operator (@) is especially useful in tests because: 1. It requires any/all statements to be explicitly marked. The suppressWarnings/restoreWarnings sections encourage developers to be "lazy" and thus encapsulate more than needed if there are multiple ones near each other, which would ignore potentially important warnings in a test case, which is generally exactly the time when it is really useful to get warnings etc. 2. It avoids leaking state, for example in LBFactoryTest the assertFalse call would throw a PHPUnit assertion error (not meant to be caught by the local catch), and thus won't reach AtEase::restoreWarnings. This then causes later code to end up in a mismatching state and creates a confusing error_reporting state. See .phpcs.xml, where the at operator is allowed for all test code. Change-Id: I68d1725d685e0a7586468bc9de6dc29ceea31b8a
127 lines
4.1 KiB
PHP
127 lines
4.1 KiB
PHP
<?php
|
|
|
|
namespace MediaWiki\Session;
|
|
|
|
use MediaWikiIntegrationTestCase;
|
|
use Psr\Log\LogLevel;
|
|
use User;
|
|
use Wikimedia\TestingAccessWrapper;
|
|
|
|
/**
|
|
* @group Session
|
|
* @covers \MediaWiki\Session\Session
|
|
*/
|
|
class SessionTest extends MediaWikiIntegrationTestCase {
|
|
|
|
public function testClear() {
|
|
$session = TestUtils::getDummySession();
|
|
$priv = TestingAccessWrapper::newFromObject( $session );
|
|
|
|
$backend = $this->getMockBuilder( DummySessionBackend::class )
|
|
->addMethods( [ 'canSetUser', 'setUser', 'save' ] )
|
|
->getMock();
|
|
$backend->expects( $this->once() )->method( 'canSetUser' )
|
|
->willReturn( true );
|
|
$backend->expects( $this->once() )->method( 'setUser' )
|
|
->with( $this->callback( static function ( $user ) {
|
|
return $user instanceof User && $user->isAnon();
|
|
} ) );
|
|
$backend->expects( $this->once() )->method( 'save' );
|
|
$priv->backend = $backend;
|
|
$session->clear();
|
|
$this->assertSame( [], $backend->data );
|
|
$this->assertTrue( $backend->dirty );
|
|
|
|
$backend = $this->getMockBuilder( DummySessionBackend::class )
|
|
->addMethods( [ 'canSetUser', 'setUser', 'save' ] )
|
|
->getMock();
|
|
$backend->data = [];
|
|
$backend->expects( $this->once() )->method( 'canSetUser' )
|
|
->willReturn( true );
|
|
$backend->expects( $this->once() )->method( 'setUser' )
|
|
->with( $this->callback( static function ( $user ) {
|
|
return $user instanceof User && $user->isAnon();
|
|
} ) );
|
|
$backend->expects( $this->once() )->method( 'save' );
|
|
$priv->backend = $backend;
|
|
$session->clear();
|
|
$this->assertFalse( $backend->dirty );
|
|
|
|
$backend = $this->getMockBuilder( DummySessionBackend::class )
|
|
->addMethods( [ 'canSetUser', 'setUser', 'save' ] )
|
|
->getMock();
|
|
$backend->expects( $this->once() )->method( 'canSetUser' )
|
|
->willReturn( false );
|
|
$backend->expects( $this->never() )->method( 'setUser' );
|
|
$backend->expects( $this->once() )->method( 'save' );
|
|
$priv->backend = $backend;
|
|
$session->clear();
|
|
$this->assertSame( [], $backend->data );
|
|
$this->assertTrue( $backend->dirty );
|
|
}
|
|
|
|
public function testSecrets() {
|
|
$logger = new \TestLogger;
|
|
$session = TestUtils::getDummySession( null, -1, $logger );
|
|
|
|
// Simple defaulting
|
|
$this->assertEquals( 'defaulted', $session->getSecret( 'test', 'defaulted' ) );
|
|
|
|
// Bad encrypted data
|
|
$session->set( 'test', 'foobar' );
|
|
$logger->setCollect( true );
|
|
$this->assertEquals( 'defaulted', $session->getSecret( 'test', 'defaulted' ) );
|
|
$logger->setCollect( false );
|
|
$this->assertSame( [
|
|
[ LogLevel::WARNING, 'Invalid sealed-secret format' ]
|
|
], $logger->getBuffer() );
|
|
$logger->clearBuffer();
|
|
|
|
// Tampered data
|
|
$session->setSecret( 'test', 'foobar' );
|
|
$encrypted = $session->get( 'test' );
|
|
$session->set( 'test', $encrypted . 'x' );
|
|
$logger->setCollect( true );
|
|
$this->assertEquals( 'defaulted', $session->getSecret( 'test', 'defaulted' ) );
|
|
$logger->setCollect( false );
|
|
$this->assertSame( [
|
|
[ LogLevel::WARNING, 'Sealed secret has been tampered with, aborting.' ]
|
|
], $logger->getBuffer() );
|
|
$logger->clearBuffer();
|
|
|
|
// Unserializable data
|
|
$iv = random_bytes( 16 );
|
|
list( $encKey, $hmacKey ) = TestingAccessWrapper::newFromObject( $session )->getSecretKeys();
|
|
$ciphertext = openssl_encrypt( 'foobar', 'aes-256-ctr', $encKey, OPENSSL_RAW_DATA, $iv );
|
|
$sealed = base64_encode( $iv ) . '.' . base64_encode( $ciphertext );
|
|
$hmac = hash_hmac( 'sha256', $sealed, $hmacKey, true );
|
|
$encrypted = base64_encode( $hmac ) . '.' . $sealed;
|
|
$session->set( 'test', $encrypted );
|
|
$this->assertEquals( 'defaulted', @$session->getSecret( 'test', 'defaulted' ) );
|
|
}
|
|
|
|
/**
|
|
* @dataProvider provideSecretsRoundTripping
|
|
*/
|
|
public function testSecretsRoundTripping( $data ) {
|
|
$session = TestUtils::getDummySession();
|
|
|
|
// Simple round-trip
|
|
$session->setSecret( 'secret', $data );
|
|
$this->assertNotEquals( $data, $session->get( 'secret' ) );
|
|
$this->assertEquals( $data, $session->getSecret( 'secret', 'defaulted' ) );
|
|
}
|
|
|
|
public static function provideSecretsRoundTripping() {
|
|
return [
|
|
[ 'Foobar' ],
|
|
[ 42 ],
|
|
[ [ 'foo', 'bar' => 'baz', 'subarray' => [ 1, 2, 3 ] ] ],
|
|
[ (object)[ 'foo', 'bar' => 'baz', 'subarray' => [ 1, 2, 3 ] ] ],
|
|
[ true ],
|
|
[ false ],
|
|
[ null ],
|
|
];
|
|
}
|
|
|
|
}
|