genuineparts/alltube
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge tag '3.0.2' into develop

Browse source 
Fixed a SSRF vulnerability that could be used to send a request to an internal hostname
This commit is contained in:
Pierre Rudloff 2022-02-27 12:34:23 +01:00
commit 7f28275fb0
8 changed files with 866 additions and 147 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/FrontControllerTest.php
View file

@ -11,6 +11,7 @@ use Alltube\Exception\ConfigException;
use Alltube\Exception\DependencyException;
use Alltube\Library\Exception\AlltubeLibraryException;
use Exception;
use Graby\HttpClient\Plugin\ServerSideRequestForgeryProtection\Exception\InvalidURLException;
use Slim\Http\Environment;
use Slim\Http\Request;
use SmartyException;
@ -113,7 +114,8 @@ class FrontControllerTest extends ControllerTest
*/
public function testInfoWithoutUrl()
{
$this->assertRequestIsRedirect('info');
$this->expectException(InvalidURLException::class);
$this->getRequestResult('info', []);
}
/**