Commit 1131fffa authored by catch's avatar catch
Browse files

task: #3633178 Add test coverage for SA-CORE-2026-002 

By: xjm
By: benjifisher
By: cilefen
By: drumm
By: greggles
By: larowlan
By: longwave
By: mcdruid
By: ram4nd
By: smustgrave
(cherry picked from commit a6eb2a60)
parent 4f642ae4

core/modules/views/tests/src/Kernel/ViewExecutableTest.php

+18 −0
Changes for core/modules/views/tests/src/Kernel/ViewExecutableTest.php: 18 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -556,6 +556,24 @@ public function testSerialization(): void { 
    $this->assertEquals($nid_definition_before->getPropertyDefinitions(), $nid_definition_after->getPropertyDefinitions());

  }



  /**

   * Tests that tampered serialized ViewExecutable data throws an exception.

   */

  public function testTamperedDeserializationT(): void {

    $this->expectException(\RuntimeException::class);

    $this->expectExceptionMessage('Deserialization of Drupal\views\ViewExecutable::$built is not allowed.');

    unserialize('O:27:"Drupal\views\ViewExecutable":2:{s:5:"built";b:1;s:5:"pager";i:1;}');

  }



  /**

   * Tests that tampered serializationData keys throw an exception.

   */

  public function testTamperedSerializationData(): void {

    $this->expectException(\RuntimeException::class);

    $this->expectExceptionMessage('Unexpected keys in Drupal\views\ViewExecutable::$serializationData.');

    unserialize('O:27:"Drupal\views\ViewExecutable":1:{s:17:"serializationData";a:1:{s:9:"malicious";s:4:"test";}}');

  }



  /**

   * Tests if argument overrides by validators are propagated to tokens.

   */

core/tests/Drupal/Tests/Core/Template/AttributeTest.php

+18 −0
Changes for core/tests/Drupal/Tests/Core/Template/AttributeTest.php: 18 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -15,9 +15,12 @@ 
use PHPUnit\Framework\Attributes\CoversClass;

use PHPUnit\Framework\Attributes\DataProvider;

use PHPUnit\Framework\Attributes\Group;

use PHPUnit\Framework\Attributes\IgnoreDeprecations;

use Twig\Environment;

use Twig\Markup as TwigMarkup;



// cspell:ignore phpggc



/**

 * Tests Drupal\Core\Template\Attribute.

 */
@@ -549,4 +552,19 @@ public function testMergeArgumentException(): void { 
    $attributes->merge('not an array');

  }



  /**

   * Tests type enforcement in \Drupal\Core\Template\Attribute::__toString.

   */

  #[IgnoreDeprecations]

  public function testAttributeGadgetChain(): void {

    // The Gadget Chain itself may trigger a deprecation before the Exception

    // that prevents the payload from executing is thrown, so we ignore

    // deprecations for this test.

    $payload = 'O:30:"Drupal\Core\Template\Attribute":1:{s:7:"storage";a:1:{i:0;O:27:"Drupal\views\ViewExecutable":1:{s:17:"serializationData";a:9:{s:4:"args";N;s:15:"current_display";N;s:12:"current_page";N;s:6:"dom_id";N;s:8:"executed";N;s:12:"exposed_data";N;s:13:"exposed_input";N;s:17:"exposed_raw_input";N;s:7:"storage";N;}}}}';

    $this->expectException(\RuntimeException::class);

    $this->expectExceptionMessage('Unexpected type for $value (Drupal\views\ViewExecutable).');

    // The print is to invoke the __toString() method.

    print unserialize($payload);

  }



}