Skip to content

Commit dc27173

Browse files
stonebuzzstonebuzz
committed
Test: add PHPUnit infrastructure and CSV formula escaping test
Backport the test shipped with PR #656, along with the PHPUnit setup the GLPI 10.0 line was missing: the CI workflow runs PHPUnit as soon as a phpunit.xml exists at the plugin root, using the GLPI core binary.
1 parent 589571c commit dc27173

7 files changed

Lines changed: 130 additions & 1 deletion

File tree

‎.phpunit.result.cache‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":1,"defects":[],"times":{"ClientInjectionEscapeCsvFormulaTest::testEscapeCsvFormula with data set \"empty string\"":0.023,"ClientInjectionEscapeCsvFormulaTest::testEscapeCsvFormula with data set \"equals trigger\"":0.016,"ClientInjectionEscapeCsvFormulaTest::testEscapeCsvFormula with data set \"plus trigger\"":0.015,"ClientInjectionEscapeCsvFormulaTest::testEscapeCsvFormula with data set \"minus trigger\"":0.016,"ClientInjectionEscapeCsvFormulaTest::testEscapeCsvFormula with data set \"at trigger\"":0.015,"ClientInjectionEscapeCsvFormulaTest::testEscapeCsvFormula with data set \"safe value passthrough\"":0.014,"ClientInjectionEscapeCsvFormulaTest::testEscapeCsvFormula with data set \"non-string passthrough\"":0.014}}

‎Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
include ../../PluginsMakefile.mk

‎hook.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,12 @@ function plugin_datainjection_uninstall()
210210
}
211211
}
212212

213+
// Remove plugin rights from all profiles
214+
$profileRight = new ProfileRight();
215+
foreach (PluginDatainjectionProfile::getAllRights() as $right) {
216+
$profileRight->deleteByCriteria(['name' => $right['field']]);
217+
}
218+
213219
if (is_dir(PLUGIN_DATAINJECTION_UPLOAD_DIR)) {
214220
Toolbox::deleteDir(PLUGIN_DATAINJECTION_UPLOAD_DIR);
215221
}

‎inc/model.class.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@
2828
* -------------------------------------------------------------------------
2929
*/
3030

31+
use Glpi\Toolbox\Sanitizer;
32+
3133
class PluginDatainjectionModel extends CommonDBTM
3234
{
3335
public static $rightname = "plugin_datainjection_model";
@@ -1317,7 +1319,7 @@ public function switchReadyToUse()
13171319

13181320
$tmp = $this->fields;
13191321
$tmp['step'] = self::READY_TO_USE_STEP;
1320-
$tmp = Toolbox::addslashes_deep($tmp);
1322+
$tmp = Sanitizer::dbEscapeRecursive($tmp);
13211323
$this->update($tmp);
13221324
}
13231325

‎phpunit.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<phpunit bootstrap="tests/bootstrap.php" colors="true" testdox="true">
2+
<testsuites>
3+
<testsuite name="Tests">
4+
<directory suffix="Test.php">tests</directory>
5+
</testsuite>
6+
</testsuites>
7+
</phpunit>

‎tests/bootstrap.php‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
<?php
2+
3+
/**
4+
* -------------------------------------------------------------------------
5+
* DataInjection plugin for GLPI
6+
* -------------------------------------------------------------------------
7+
*
8+
* LICENSE
9+
*
10+
* This file is part of DataInjection.
11+
*
12+
* DataInjection is free software; you can redistribute it and/or modify
13+
* it under the terms of the GNU General Public License as published by
14+
* the Free Software Foundation; either version 2 of the License, or
15+
* (at your option) any later version.
16+
*
17+
* DataInjection is distributed in the hope that it will be useful,
18+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
19+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20+
* GNU General Public License for more details.
21+
*
22+
* You should have received a copy of the GNU General Public License
23+
* along with DataInjection. If not, see <http://www.gnu.org/licenses/>.
24+
* -------------------------------------------------------------------------
25+
* @copyright Copyright (C) 2007-2023 by DataInjection plugin team.
26+
* @license GPLv2 https://www.gnu.org/licenses/gpl-2.0.html
27+
* @link https://github.com/pluginsGLPI/datainjection
28+
* -------------------------------------------------------------------------
29+
*/
30+
31+
global $CFG_GLPI, $PLUGIN_HOOKS;
32+
33+
define('GLPI_ROOT', dirname(__DIR__, 3));
34+
define('GLPI_LOG_DIR', GLPI_ROOT . '/files/_logs');
35+
define('TU_USER', 'glpi');
36+
define('TU_PASS', 'glpi');
37+
define('GLPI_LOG_LVL', 'DEBUG');
38+
39+
require GLPI_ROOT . '/inc/includes.php';
40+
41+
include_once GLPI_ROOT . '/phpunit/GLPITestCase.php';
42+
include_once GLPI_ROOT . '/phpunit/DbTestCase.php';
43+
44+
require_once __DIR__ . '/../setup.php';
45+
46+
if (!Plugin::isPluginActive('datainjection')) {
47+
throw new RuntimeException('Plugin datainjection is not active in the test database');
48+
}

‎tests/unit/ClientInjectionEscapeCsvFormulaTest.php‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
<?php
2+
3+
/**
4+
* -------------------------------------------------------------------------
5+
* DataInjection plugin for GLPI
6+
* -------------------------------------------------------------------------
7+
*
8+
* LICENSE
9+
*
10+
* This file is part of DataInjection.
11+
*
12+
* DataInjection is free software; you can redistribute it and/or modify
13+
* it under the terms of the GNU General Public License as published by
14+
* the Free Software Foundation; either version 2 of the License, or
15+
* (at your option) any later version.
16+
*
17+
* DataInjection is distributed in the hope that it will be useful,
18+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
19+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20+
* GNU General Public License for more details.
21+
*
22+
* You should have received a copy of the GNU General Public License
23+
* along with DataInjection. If not, see <http://www.gnu.org/licenses/>.
24+
* -------------------------------------------------------------------------
25+
* @copyright Copyright (C) 2007-2023 by DataInjection plugin team.
26+
* @license GPLv2 https://www.gnu.org/licenses/gpl-2.0.html
27+
* @link https://github.com/pluginsGLPI/datainjection
28+
* -------------------------------------------------------------------------
29+
*/
30+
31+
require_once dirname(__DIR__, 2) . '/inc/clientinjection.class.php';
32+
33+
/**
34+
* Covers escapeCsvFormula(), which prefixes values starting with a CSV
35+
* formula-injection trigger character with a single quote before they are
36+
* written out by exportErrorsInCSV().
37+
*/
38+
class ClientInjectionEscapeCsvFormulaTest extends DbTestCase
39+
{
40+
public function escapeCsvFormulaProvider(): array
41+
{
42+
return [
43+
'empty string' => ['', ''],
44+
'equals trigger' => ['=SUM(A1:A2)', "'=SUM(A1:A2)"],
45+
'plus trigger' => ['+1234', "'+1234"],
46+
'minus trigger' => ['-1234', "'-1234"],
47+
'at trigger' => ['@SUM(A1:A2)', "'@SUM(A1:A2)"],
48+
'safe value passthrough' => ['normal value', 'normal value'],
49+
'non-string passthrough' => [42, 42],
50+
];
51+
}
52+
53+
/**
54+
* @dataProvider escapeCsvFormulaProvider
55+
*/
56+
public function testEscapeCsvFormula($value, $expected): void
57+
{
58+
$escape_csv_formula = new ReflectionMethod(
59+
PluginDatainjectionClientInjection::class,
60+
'escapeCsvFormula'
61+
);
62+
$this->assertSame($expected, $escape_csv_formula->invoke(null, $value));
63+
}
64+
}

0 commit comments

Comments
 (0)