diff --git a/core/lib/Drupal/Component/Utility/UrlHelper.php b/core/lib/Drupal/Component/Utility/UrlHelper.php index 5f67181..1564f82 100644 --- a/core/lib/Drupal/Component/Utility/UrlHelper.php +++ b/core/lib/Drupal/Component/Utility/UrlHelper.php @@ -214,11 +214,11 @@ public static function encodePath($path) { */ public static function isExternal($path) { $colonpos = strpos($path, ':'); - // Avoid calling drupal_strip_dangerous_protocols() if there is any slash (/), - // hash (#) or question_mark (?) before the colon (:) occurrence - if any - as - // this would clearly mean it is not a URL. If the path starts with 2 slashes - // then it is always considered an external URL without an explicit protocol - // part. + // Avoid calling drupal_strip_dangerous_protocols() if there is any slash + // (/), hash (#) or question_mark (?) before the colon (:) occurrence - if + // any - as this would clearly mean it is not a URL. If the path starts with + // 2 slashes then it is always considered an external URL without an + // explicit protocol part. return (strpos($path, '//') === 0) || ($colonpos !== FALSE && !preg_match('![/?#]!', substr($path, 0, $colonpos)) diff --git a/core/lib/Drupal/Core/EventSubscriber/RedirectResponseSubscriber.php b/core/lib/Drupal/Core/EventSubscriber/RedirectResponseSubscriber.php index 4b802d2..0573eea 100644 --- a/core/lib/Drupal/Core/EventSubscriber/RedirectResponseSubscriber.php +++ b/core/lib/Drupal/Core/EventSubscriber/RedirectResponseSubscriber.php @@ -95,6 +95,9 @@ public function checkRedirectUrl(FilterResponseEvent $event) { /** * Sanitize the destination parameter to prevent open redirect attacks. + * + * @param \Symfony\Component\HttpKernel\Event\GetResponseEvent $event + * The Event to process. */ public function sanitizeDestination(GetResponseEvent $event) { $request = $event->getRequest(); diff --git a/core/lib/Drupal/Core/Routing/UrlGenerator.php b/core/lib/Drupal/Core/Routing/UrlGenerator.php index c305e91..ba84275 100644 --- a/core/lib/Drupal/Core/Routing/UrlGenerator.php +++ b/core/lib/Drupal/Core/Routing/UrlGenerator.php @@ -245,16 +245,16 @@ public function generateFromPath($path = NULL, $options = array()) { 'prefix' => '', ); - // A duplicate of the code from \Drupal\Component\Utility\UrlHelper::isExternal() - // to avoid needing another function call, since performance inside url() - // is critical. + // A duplicate of the code from + // \Drupal\Component\Utility\UrlHelper::isExternal() to avoid needing + // another function call, since performance inside url() is critical. if (!isset($options['external'])) { $colonpos = strpos($path, ':'); - // Avoid calling drupal_strip_dangerous_protocols() if there is any slash (/), - // hash (#) or question_mark (?) before the colon (:) occurrence - if any - as - // this would clearly mean it is not a URL. If the path starts with 2 slashes - // then it is always considered an external URL without an explicit protocol - // part. + // Avoid calling drupal_strip_dangerous_protocols() if there is any slash + // (/), hash (#) or question_mark (?) before the colon (:) occurrence - + // if any - as this would clearly mean it is not a URL. If the path starts + // with 2 slashes then it is always considered an external URL without an + // explicit protocol part. $options['external'] = (strpos($path, '//') === 0) || ($colonpos !== FALSE && !preg_match('![/?#]!', substr($path, 0, $colonpos)) diff --git a/core/lib/Drupal/Core/Utility/UnroutedUrlAssembler.php b/core/lib/Drupal/Core/Utility/UnroutedUrlAssembler.php index 6af92f7..2aed98e 100644 --- a/core/lib/Drupal/Core/Utility/UnroutedUrlAssembler.php +++ b/core/lib/Drupal/Core/Utility/UnroutedUrlAssembler.php @@ -113,8 +113,8 @@ protected function buildLocalUrl($uri, array $options = []) { // https://www.drupal.org/node/2417459 $uri = substr($uri, 5); - // Strip leading slashes from internal paths to prevent them becoming external - // URLs without protocol. /example.com should not be turned into + // Strip leading slashes from internal paths to prevent them becoming + // external URLs without protocol. /example.com should not be turned into // //example.com. $uri = ltrim($uri, '/'); diff --git a/core/modules/system/src/Tests/Form/ConfirmFormTest.php b/core/modules/system/src/Tests/Form/ConfirmFormTest.php index bd13a1f..9521176 100644 --- a/core/modules/system/src/Tests/Form/ConfirmFormTest.php +++ b/core/modules/system/src/Tests/Form/ConfirmFormTest.php @@ -25,7 +25,7 @@ class ConfirmFormTest extends WebTestBase { */ public static $modules = array('form_test'); - function ptestConfirmForm() { + function testConfirmForm() { // Test the building of the form. $this->drupalGet('form-test/confirm-form'); $site_name = $this->config('system.site')->get('name'); @@ -66,12 +66,21 @@ public function testConfirmFormWithExternalDestination() { /** * Asserts that a cancel link is present pointing to the provided URL. + * + * @param \Drupal\Core\Url $url + * The url to check for. + * @param string $message + * The assert message. + * @param string $group + * The assertion group. + * + * @return bool + * Result of the assertion. */ - function assertCancelLinkUrl(Url $url, $message = '', $group = 'Other') { + public function assertCancelLinkUrl(Url $url, $message = '', $group = 'Other') { $links = $this->xpath('//a[@href=:url]', [':url' => $url->toString()]); $message = ($message ? $message : String::format('Cancel link with url %url found.', ['%url' => $url->toString()])); return $this->assertTrue(isset($links[0]), $message, $group); } - } diff --git a/core/tests/Drupal/Tests/Component/Utility/UrlHelperTest.php b/core/tests/Drupal/Tests/Component/Utility/UrlHelperTest.php index 537def6..9480a7e 100644 --- a/core/tests/Drupal/Tests/Component/Utility/UrlHelperTest.php +++ b/core/tests/Drupal/Tests/Component/Utility/UrlHelperTest.php @@ -358,7 +358,7 @@ public static function providerTestIsExternal() { array('/internal/path', FALSE), array('https://example.com/external/path', TRUE), array('javascript://fake-external-path', FALSE), - // External URL without an explicit protocol. + // External URL without an explicit protocol. array('//drupal.org/foo/bar?foo=bar&bar=baz&baz#foo', TRUE), // Internal URL starting with a slash. array('/drupal.org', FALSE), diff --git a/core/tests/Drupal/Tests/Core/EventSubscriber/RedirectResponseSubscriberTest.php b/core/tests/Drupal/Tests/Core/EventSubscriber/RedirectResponseSubscriberTest.php index bbb78ad..51f2991 100644 --- a/core/tests/Drupal/Tests/Core/EventSubscriber/RedirectResponseSubscriberTest.php +++ b/core/tests/Drupal/Tests/Core/EventSubscriber/RedirectResponseSubscriberTest.php @@ -105,7 +105,7 @@ public static function providerTestDestinationRedirect() { * * @dataProvider providerTestDestinationRedirectWithInvalidUrl */ - public function testDestinationRedirectWithInvalidUrl($request) { + public function testDestinationRedirectWithInvalidUrl(Request $request) { $dispatcher = new EventDispatcher(); $kernel = $this->getMock('Symfony\Component\HttpKernel\HttpKernelInterface'); $response = new RedirectResponse('http://example.com/drupal'); @@ -121,6 +121,9 @@ public function testDestinationRedirectWithInvalidUrl($request) { $dispatcher->dispatch(KernelEvents::RESPONSE, $event); } + /** + * Data provider for testDestinationRedirectWithInvalidUrl(). + */ public function providerTestDestinationRedirectWithInvalidUrl() { $data = []; $data[] = [new Request(array('destination' => '//example:com'))]; @@ -186,7 +189,8 @@ public function testSanitizeDestinationForPost($input, $output) { */ public function providerTestSanitizeDestination() { $data = []; - // Standard internal example node path is present in the 'destination' parameter. + // Standard internal example node path is present in the 'destination' + // parameter. $data[] = ['node', 'node']; // Internal path with one leading slash is allowed. $data[] = ['/example.com', '/example.com']; diff --git a/core/tests/Drupal/Tests/Core/Routing/RedirectDestinationTest.php b/core/tests/Drupal/Tests/Core/Routing/RedirectDestinationTest.php index 0545c4b..e305bd1 100644 --- a/core/tests/Drupal/Tests/Core/Routing/RedirectDestinationTest.php +++ b/core/tests/Drupal/Tests/Core/Routing/RedirectDestinationTest.php @@ -64,6 +64,13 @@ protected function setupUrlGenerator() { } /** + * Tests destination passed via $_GET. + * + * @param \Symfony\Component\HttpFoundation\Request $request + * The request to test. + * @param string $expected_destination + * The expected destination. + * * @dataProvider providerGet * * @covers ::get