wiki.techinc.nl/tests/phpunit/includes/api/format/ApiFormatJsonTest.php
csteipp fe32899523 SECURITY: Prepend jsonp callback with comment
Mitigate CVE-2014-4671 for unpatched flash players

Bug: 68187
Change-Id: I2f46e623c1f541dbbafb6e8333e0929055098b15
2014-07-30 20:26:39 +02:00

22 lines
634 B
PHP

<?php
/**
* @group API
* @group Database
* @group medium
* @covers ApiFormatJson
*/
class ApiFormatJsonTest extends ApiFormatTestBase {
public function testValidSyntax( ) {
$data = $this->apiRequest( 'json', array( 'action' => 'query', 'meta' => 'siteinfo' ) );
$this->assertInternalType( 'array', json_decode( $data, true ) );
$this->assertGreaterThan( 0, count( (array)$data ) );
}
public function testJsonpInjection( ) {
$data = $this->apiRequest( 'json', array( 'action' => 'query', 'meta' => 'siteinfo', 'callback' => 'myCallback' ) );
$this->assertEquals( '/**/myCallback(', substr( $data, 0, 15 ) );
}
}