Merge branch 'security-fixes-lfi-xss-open-redirect' into 'dev'

Security fixes

See merge request hubzilla/core!2017

2 files changed, 53 insertions, 0 deletions

diff --git a/tests/unit/AntiXSSTest.php b/tests/unit/AntiXSSTest.php
index b45042a1e..09642726f 100644
--- a/tests/unit/AntiXSSTest.php
+++ b/tests/unit/AntiXSSTest.php
@@ -24,6 +24,26 @@ class AntiXSSTest extends TestCase {
 		$this->assertEquals("<submit type="button" onclick="alert('failed!');" />", $escapedString);
 	}
 
+  /**
+   * @dataProvider urlTestProvider
+   */
+  public function testEscapeURL($url, $expected) : void {
+    $this->assertEquals($expected, escape_url($url));
+  }
+
+  public function urlTestProvider() : array {
+    return [
+      [
+        "https://example.com/settings/calendar/?f=&rpath=https://example.com/cdav/calendar'><script>alert('boom')</script>",
+        "https://example.com/settings/calendar/?f=&amp;rpath=https://example.com/cdav/calendar&apos;&gt;&lt;script&gt;alert(&apos;boom&apos;)&lt;/script&gt;"
+      ],
+      [
+        "settings/calendar/?f=&rpath=https://example.com'+accesskey=x+onclick=alert(/boom/);a='",
+        "settings/calendar/?f=&amp;rpath=https://example.com&apos;+accesskey=x+onclick=alert(/boom/);a=&apos;"
+      ],
+    ];
+  }
+
 	/**
 	 *xmlify and unxmlify
 	 */
diff --git a/tests/unit/includes/NetworkTest.php b/tests/unit/includes/NetworkTest.php
new file mode 100644
index 000000000..0b9b42e00
--- /dev/null
+++ b/tests/unit/includes/NetworkTest.php
@@ -0,0 +1,33 @@
+<?php
+/**
+ * tests function from include/network.php
+ *
+ * @package test.util
+ */
+
+use PHPUnit\Framework\TestCase;
+
+require_once('include/network.php');
+
+class NetworkTest extends TestCase {
+
+  public function setup() : void {
+    \App::set_baseurl("https://mytest.org");
+  }
+
+  /**
+   * @dataProvider localUrlTestProvider
+   */
+  public function testIsLocalURL($url, $expected) {
+    $this->assertEquals($expected, is_local_url($url));
+  }
+
+  public function localUrlTestProvider() : array {
+    return [
+      [ '/some/path', true ],
+      [ 'https://mytest.org/some/path', true ],
+      [ 'https://other.site/some/path', false ],
+    ];
+  }
+}
+