11<?php
2-
32use PHPUnit \Framework \TestCase ;
43use UnityWebPortal \lib \CSRFToken ;
54
@@ -21,18 +20,14 @@ protected function tearDown(): void
2120 public function testGenerateCreatesToken (): void
2221 {
2322 $ token = CSRFToken::generate ();
24-
2523 $ this ->assertIsString ($ token );
26-
2724 $ this ->assertEquals (64 , strlen ($ token ));
28-
2925 $ this ->assertMatchesRegularExpression ('/^[0-9a-f]{64}$/ ' , $ token );
3026 }
3127
3228 public function testGenerateStoresTokenInSession (): void
3329 {
3430 $ token = CSRFToken::generate ();
35-
3631 $ this ->assertArrayHasKey ("csrf_tokens " , $ _SESSION );
3732 $ this ->assertArrayHasKey ($ token , $ _SESSION ["csrf_tokens " ]);
3833 $ this ->assertFalse ($ _SESSION ["csrf_tokens " ][$ token ]);
@@ -41,22 +36,19 @@ public function testGenerateStoresTokenInSession(): void
4136 public function testValidateWithValidToken (): void
4237 {
4338 $ token = CSRFToken::generate ();
44-
4539 $ this ->assertTrue (CSRFToken::validate ($ token ));
4640 $ this ->assertTrue ($ _SESSION ["csrf_tokens " ][$ token ]);
4741 }
4842
4943 public function testValidateWithInvalidToken (): void
5044 {
5145 CSRFToken::generate ();
52-
5346 $ this ->assertFalse (CSRFToken::validate ("invalid_token " ));
5447 }
5548
5649 public function testValidateWithEmptyToken (): void
5750 {
5851 CSRFToken::generate ();
59-
6052 $ this ->assertFalse (CSRFToken::validate ("" ));
6153 }
6254
@@ -74,44 +66,18 @@ public function testValidateUsesConstantTimeComparison(): void
7466 $ this ->assertTrue ($ _SESSION ["csrf_tokens " ][$ token ]);
7567 }
7668
77- public function testGetHiddenInputReturnsHtmlField (): void
78- {
79- $ html = CSRFToken::getHiddenInput ();
80-
81- $ this ->assertStringContainsString ("<input " , $ html );
82- $ this ->assertStringContainsString ('type= \'hidden \'' , $ html );
83- $ this ->assertStringContainsString ('name= \'csrf_token \'' , $ html );
84- $ matches = [];
85- $ this ->assertTrue (preg_match ("/value='([a-f0-9]{64})'/ " , $ html , $ matches ) === 1 );
86- $ token = $ matches [1 ];
87- $ this ->assertArrayHasKey ("csrf_tokens " , $ _SESSION );
88- $ this ->assertArrayHasKey ($ token , $ _SESSION ["csrf_tokens " ]);
89- $ this ->assertFalse ($ _SESSION ["csrf_tokens " ][$ token ]);
90- }
91-
92- public function testGetHiddenInputEscapesToken (): void
93- {
94- $ html = CSRFToken::getHiddenInput ();
95-
96- $ this ->assertStringNotContainsString ("<script> " , $ html );
97- $ this ->assertStringContainsString ("& " , $ html );
98- }
99-
10069 public function testClearRemovesToken (): void
10170 {
10271 CSRFToken::generate ();
10372 $ this ->assertArrayHasKey ("csrf_tokens " , $ _SESSION );
104-
10573 CSRFToken::clear ();
106-
10774 $ this ->assertArrayNotHasKey ("csrf_tokens " , $ _SESSION );
10875 }
10976
11077 public function testMultipleTokenGenerations (): void
11178 {
11279 $ token1 = CSRFToken::generate ();
11380 $ token2 = CSRFToken::generate ();
114-
11581 $ this ->assertNotEquals ($ token1 , $ token2 );
11682 }
11783
0 commit comments