View source
<?php
namespace Drupal\KernelTests\Core\Routing;
use Drupal\Component\Utility\Html;
use Drupal\Core\Cache\CacheableJsonResponse;
use Drupal\KernelTests\KernelTestBase;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
class ExceptionHandlingTest extends KernelTestBase {
protected static $modules = [
'system',
'router_test',
];
protected function setUp() : void {
parent::setUp();
$this
->installEntitySchema('date_format');
}
public function test405() {
$request = Request::create('/router_test/test15', 'PATCH');
$kernel = \Drupal::getContainer()
->get('http_kernel');
$response = $kernel
->handle($request);
$this
->assertEquals(Response::HTTP_METHOD_NOT_ALLOWED, $response
->getStatusCode());
}
public function testJson403() {
$request = Request::create('/router_test/test15');
$request->query
->set('_format', 'json');
$request
->setRequestFormat('json');
$kernel = \Drupal::getContainer()
->get('http_kernel');
$response = $kernel
->handle($request);
$this
->assertEquals(Response::HTTP_FORBIDDEN, $response
->getStatusCode());
$this
->assertEquals('application/json', $response->headers
->get('Content-type'));
$this
->assertEquals('{"message":""}', $response
->getContent());
$this
->assertInstanceOf(CacheableJsonResponse::class, $response);
}
public function testJson404() {
$request = Request::create('/not-found');
$request->query
->set('_format', 'json');
$request
->setRequestFormat('json');
$kernel = \Drupal::getContainer()
->get('http_kernel');
$response = $kernel
->handle($request);
$this
->assertEquals(Response::HTTP_NOT_FOUND, $response
->getStatusCode());
$this
->assertEquals('application/json', $response->headers
->get('Content-type'));
$this
->assertEquals('{"message":"No route found for \\u0022GET \\/not-found\\u0022"}', $response
->getContent());
}
public function testHtml403() {
$request = Request::create('/router_test/test15');
$request
->setFormat('html', [
'text/html',
]);
$kernel = \Drupal::getContainer()
->get('http_kernel');
$response = $kernel
->handle($request)
->prepare($request);
$this
->assertEquals(Response::HTTP_FORBIDDEN, $response
->getStatusCode());
$this
->assertEquals('text/html; charset=UTF-8', $response->headers
->get('Content-type'));
}
public function testHtml404() {
$request = Request::create('/not-found');
$request
->setFormat('html', [
'text/html',
]);
$kernel = \Drupal::getContainer()
->get('http_kernel');
$response = $kernel
->handle($request)
->prepare($request);
$this
->assertEquals(Response::HTTP_NOT_FOUND, $response
->getStatusCode());
$this
->assertEquals('text/html; charset=UTF-8', $response->headers
->get('Content-type'));
}
public function testExceptionResponseGeneratedForOriginalRequest() {
$response = $this
->doTest404Route('/router_test/test25');
$this
->assertStringContainsString('/not-found', $response
->getContent());
$response = $this
->doTest404Route('/router_test/test26');
$this
->assertStringContainsString('<form class="system-logging-settings"', $response
->getContent());
$response = $this
->doTest404Route('/router_test/test27');
$this
->assertStringContainsString('<form class="date-format-add-form date-format-form"', $response
->getContent());
}
protected function doTest404Route($path) {
$this
->config('system.site')
->set('page.404', $path)
->save();
$request = Request::create('/not-found');
$request
->setFormat('html', [
'text/html',
]);
$kernel = \Drupal::getContainer()
->get('http_kernel');
return $kernel
->handle($request)
->prepare($request);
}
public function testBacktraceEscaping() {
$this
->config('system.logging')
->set('error_level', ERROR_REPORTING_DISPLAY_VERBOSE)
->save();
$request = Request::create('/router_test/test17');
$request
->setFormat('html', [
'text/html',
]);
$kernel = \Drupal::getContainer()
->get('http_kernel');
$response = $kernel
->handle($request)
->prepare($request);
$this
->assertEquals(Response::HTTP_INTERNAL_SERVER_ERROR, $response
->getStatusCode());
$this
->assertEquals('text/html; charset=UTF-8', $response->headers
->get('Content-type'));
$this
->assertStringContainsString(Html::escape('<script>alert(\'xss\')</script>'), $response
->getContent());
$this
->assertStringNotContainsString('<script>alert(\'xss\')</script>', $response
->getContent());
}
public function testExceptionEscaping() {
$this
->config('system.logging')
->set('error_level', ERROR_REPORTING_DISPLAY_VERBOSE)
->save();
$request = Request::create('/router_test/test24');
$request
->setFormat('html', [
'text/html',
]);
$kernel = \Drupal::getContainer()
->get('http_kernel');
$response = $kernel
->handle($request)
->prepare($request);
$this
->assertEquals(Response::HTTP_INTERNAL_SERVER_ERROR, $response
->getStatusCode());
$this
->assertEquals('text/html; charset=UTF-8', $response->headers
->get('Content-type'));
$this
->setRawContent($response
->getContent());
$this
->assertRaw(Html::escape('Escaped content: <p> <br> <h3>'));
$this
->assertNoRaw('<p> <br> <h3>');
$string = '<script>alert(123);</script>';
$request = Request::create('/router_test/test2?_format=json' . urlencode($string), 'GET');
$kernel = \Drupal::getContainer()
->get('http_kernel');
$response = $kernel
->handle($request)
->prepare($request);
$this
->assertEquals('text/plain; charset=UTF-8', $response->headers
->get('Content-type'));
$this
->assertStringStartsWith('The website encountered an unexpected error. Please try again later.</br></br><em class="placeholder">Symfony\\Component\\HttpKernel\\Exception\\NotAcceptableHttpException</em>: Not acceptable format: json<script>alert(123);</script> in <em class="placeholder">', $response
->getContent());
}
}