Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Class FilteredIterator: add input validation #604

Merged
merged 1 commit into from
Nov 8, 2021
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion src/Utility/FilteredIterator.php
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@

use ArrayIterator;
use ReturnTypeWillChange;
use WpOrg\Requests\Exception\InvalidArgument;
use WpOrg\Requests\Utility\InputValidator;

/**
* Iterator for arrays requiring filtered values
Expand All @@ -30,11 +32,19 @@ final class FilteredIterator extends ArrayIterator {
*
* @param array $data
* @param callable $callback Callback to be called on each value
*
* @throws \WpOrg\Requests\Exception\InvalidArgument When the passed $data argument is not iterable.
*/
public function __construct($data, $callback) {
if (InputValidator::is_iterable($data) === false) {
throw InvalidArgument::create(1, '$data', 'iterable', gettype($data));
}

parent::__construct($data);

$this->callback = $callback;
if (is_callable($callback)) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As mentioned in the comment, I'd stick with the check here, but remove the one in current() (which runs unnecessarily often).

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can't remove the check in current() as $callback will be unset when the object is serialized and then unserialized (previous security fix).

$this->callback = $callback;
}
}

/**
Expand Down
140 changes: 140 additions & 0 deletions tests/Utility/FilteredIteratorTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,10 @@

use ArrayIterator;
use ReflectionClass;
use ReflectionObject;
use stdClass;
use WpOrg\Requests\Exception\InvalidArgument;
use WpOrg\Requests\Tests\Fixtures\StringableObject;
use WpOrg\Requests\Tests\TestCase;
use WpOrg\Requests\Utility\FilteredIterator;

Expand Down Expand Up @@ -66,4 +70,140 @@ public function dataSerializeDeserializeObjects() {
),
);
}

/**
* Tests that valid $data is accepted by the constructor.
*
* @dataProvider dataConstructorValidData
*
* @covers ::__construct
*
* @param mixed $input Valid input.
*
* @return void
*/
public function testConstructorValidData($input) {
$this->assertInstanceOf(FilteredIterator::class, new FilteredIterator($input, 'ltrim'));
}

/**
* Data Provider.
*
* @return array
*/
public function dataConstructorValidData() {
return array(
'array' => array(array(1, 2, 3)),
'iterable object' => array(new ArrayIterator(array(1, 2, 3))),
);
}

/**
* Tests receiving an exception when an invalid input type is passed as `$data` to the constructor.
*
* @dataProvider dataConstructorInvalidData
*
* @covers ::__construct
*
* @param mixed $input Invalid input.
*
* @return void
*/
public function testConstructorInvalidData($input) {
$this->expectException(InvalidArgument::class);
$this->expectExceptionMessage('Argument #1 ($data) must be of type iterable');

new FilteredIterator($input, 'ltrim');
}

/**
* Data Provider.
*
* @return array
*/
public function dataConstructorInvalidData() {
return array(
'null' => array(null),
'float' => array(1.1),
'stringable object' => array(new StringableObject('value')),
);
}

/**
* Tests that valid $callback is accepted by the constructor.
*
* @dataProvider dataConstructorValidCallback
*
* @covers ::__construct
*
* @param mixed $input Valid input.
*
* @return void
*/
public function testConstructorValidCallback($input) {
$obj = new FilteredIterator(array(), $input);

$reflection = new ReflectionObject($obj);
$property = $reflection->getProperty('callback');
$property->setAccessible(true);
$callback_value = $property->getValue($obj);
$property->setAccessible(false);

$this->assertSame($input, $callback_value, 'Callback property has not been set');
}

/**
* Data Provider.
*
* @return array
*/
public function dataConstructorValidCallback() {
return array(
'existing PHP native function' => array('strtolower'),
'dummy callback method' => array(array($this, 'dummyCallback')),
);
}

/**
* Tests receiving an exception when an invalid input type is passed as `$callback` to the constructor.
*
* @dataProvider dataConstructorInvalidCallback
*
* @covers ::__construct
*
* @param mixed $input Invalid callback.
*
* @return void
*/
public function testConstructorInvalidCallback($input) {
$obj = new FilteredIterator(array(), $input);

$reflection = new ReflectionObject($obj);
$property = $reflection->getProperty('callback');
$property->setAccessible(true);
$callback_value = $property->getValue($obj);
$property->setAccessible(false);

$this->assertNull($callback_value, 'Callback property has been set to invalid callback');
}

/**
* Data Provider.
*
* @return array
*/
public function dataConstructorInvalidCallback() {
return array(
'null' => array(null),
'non-existent function' => array('functionname'),
'plain object' => array(new stdClass(), 'method'),
);
}

/**
* Dummy callback method.
*
* @return void
*/
public function dummyCallback() {}
}