tests/phpunit/includes/session/ImmutableSessionProviderWithCookieTest.php

   1 <?php
   2
   3 namespace MediaWiki\Session;
   4
   5 use MediaWikiTestCase;
   6 use User;
   7
   8 /**
   9  * @group Session
  10  * @group Database
  11  * @covers MediaWiki\Session\ImmutableSessionProviderWithCookie
  12  */
  13 class ImmutableSessionProviderWithCookieTest extends MediaWikiTestCase {
  14
  15         private function getProvider( $name, $prefix = null ) {
  16                 $config = new \HashConfig();
  17                 $config->set( 'CookiePrefix', 'wgCookiePrefix' );
  18
  19                 $params = [
  20                         'sessionCookieName' => $name,
  21                         'sessionCookieOptions' => [],
  22                 ];
  23                 if ( $prefix !== null ) {
  24                         $params['sessionCookieOptions']['prefix'] = $prefix;
  25                 }
  26
  27                 $provider = $this->getMockBuilder( ImmutableSessionProviderWithCookie::class )
  28                         ->setConstructorArgs( [ $params ] )
  29                         ->getMockForAbstractClass();
  30                 $provider->setLogger( new \TestLogger() );
  31                 $provider->setConfig( $config );
  32                 $provider->setManager( new SessionManager() );
  33
  34                 return $provider;
  35         }
  36
  37         public function testConstructor() {
  38                 $provider = $this->getMockBuilder( ImmutableSessionProviderWithCookie::class )
  39                         ->getMockForAbstractClass();
  40                 $priv = \TestingAccessWrapper::newFromObject( $provider );
  41                 $this->assertNull( $priv->sessionCookieName );
  42                 $this->assertSame( [], $priv->sessionCookieOptions );
  43
  44                 $provider = $this->getMockBuilder( ImmutableSessionProviderWithCookie::class )
  45                         ->setConstructorArgs( [ [
  46                                 'sessionCookieName' => 'Foo',
  47                                 'sessionCookieOptions' => [ 'Bar' ],
  48                         ] ] )
  49                         ->getMockForAbstractClass();
  50                 $priv = \TestingAccessWrapper::newFromObject( $provider );
  51                 $this->assertSame( 'Foo', $priv->sessionCookieName );
  52                 $this->assertSame( [ 'Bar' ], $priv->sessionCookieOptions );
  53
  54                 try {
  55                         $provider = $this->getMockBuilder( ImmutableSessionProviderWithCookie::class )
  56                                 ->setConstructorArgs( [ [
  57                                         'sessionCookieName' => false,
  58                                 ] ] )
  59                                 ->getMockForAbstractClass();
  60                         $this->fail( 'Expected exception not thrown' );
  61                 } catch ( \InvalidArgumentException $ex ) {
  62                         $this->assertSame(
  63                                 'sessionCookieName must be a string',
  64                                 $ex->getMessage()
  65                         );
  66                 }
  67
  68                 try {
  69                         $provider = $this->getMockBuilder( ImmutableSessionProviderWithCookie::class )
  70                                 ->setConstructorArgs( [ [
  71                                         'sessionCookieOptions' => 'x',
  72                                 ] ] )
  73                                 ->getMockForAbstractClass();
  74                         $this->fail( 'Expected exception not thrown' );
  75                 } catch ( \InvalidArgumentException $ex ) {
  76                         $this->assertSame(
  77                                 'sessionCookieOptions must be an array',
  78                                 $ex->getMessage()
  79                         );
  80                 }
  81         }
  82
  83         public function testBasics() {
  84                 $provider = $this->getProvider( null );
  85                 $this->assertFalse( $provider->persistsSessionID() );
  86                 $this->assertFalse( $provider->canChangeUser() );
  87
  88                 $provider = $this->getProvider( 'Foo' );
  89                 $this->assertTrue( $provider->persistsSessionID() );
  90                 $this->assertFalse( $provider->canChangeUser() );
  91
  92                 $msg = $provider->whyNoSession();
  93                 $this->assertInstanceOf( 'Message', $msg );
  94                 $this->assertSame( 'sessionprovider-nocookies', $msg->getKey() );
  95         }
  96
  97         public function testGetVaryCookies() {
  98                 $provider = $this->getProvider( null );
  99                 $this->assertSame( [], $provider->getVaryCookies() );
 100
 101                 $provider = $this->getProvider( 'Foo' );
 102                 $this->assertSame( [ 'wgCookiePrefixFoo' ], $provider->getVaryCookies() );
 103
 104                 $provider = $this->getProvider( 'Foo', 'Bar' );
 105                 $this->assertSame( [ 'BarFoo' ], $provider->getVaryCookies() );
 106
 107                 $provider = $this->getProvider( 'Foo', '' );
 108                 $this->assertSame( [ 'Foo' ], $provider->getVaryCookies() );
 109         }
 110
 111         public function testGetSessionIdFromCookie() {
 112                 $this->setMwGlobals( 'wgCookiePrefix', 'wgCookiePrefix' );
 113                 $request = new \FauxRequest();
 114                 $request->setCookies( [
 115                         '' => 'empty---------------------------',
 116                         'Foo' => 'foo-----------------------------',
 117                         'wgCookiePrefixFoo' => 'wgfoo---------------------------',
 118                         'BarFoo' => 'foobar--------------------------',
 119                         'bad' => 'bad',
 120                 ], '' );
 121
 122                 $provider = \TestingAccessWrapper::newFromObject( $this->getProvider( null ) );
 123                 try {
 124                         $provider->getSessionIdFromCookie( $request );
 125                         $this->fail( 'Expected exception not thrown' );
 126                 } catch ( \BadMethodCallException $ex ) {
 127                         $this->assertSame(
 128                                 'MediaWiki\\Session\\ImmutableSessionProviderWithCookie::getSessionIdFromCookie ' .
 129                                         'may not be called when $this->sessionCookieName === null',
 130                                 $ex->getMessage()
 131                         );
 132                 }
 133
 134                 $provider = \TestingAccessWrapper::newFromObject( $this->getProvider( 'Foo' ) );
 135                 $this->assertSame(
 136                         'wgfoo---------------------------',
 137                         $provider->getSessionIdFromCookie( $request )
 138                 );
 139
 140                 $provider = \TestingAccessWrapper::newFromObject( $this->getProvider( 'Foo', 'Bar' ) );
 141                 $this->assertSame(
 142                         'foobar--------------------------',
 143                         $provider->getSessionIdFromCookie( $request )
 144                 );
 145
 146                 $provider = \TestingAccessWrapper::newFromObject( $this->getProvider( 'Foo', '' ) );
 147                 $this->assertSame(
 148                         'foo-----------------------------',
 149                         $provider->getSessionIdFromCookie( $request )
 150                 );
 151
 152                 $provider = \TestingAccessWrapper::newFromObject( $this->getProvider( 'bad', '' ) );
 153                 $this->assertSame( null, $provider->getSessionIdFromCookie( $request ) );
 154
 155                 $provider = \TestingAccessWrapper::newFromObject( $this->getProvider( 'none', '' ) );
 156                 $this->assertSame( null, $provider->getSessionIdFromCookie( $request ) );
 157         }
 158
 159         protected function getSentRequest() {
 160                 $sentResponse = $this->getMockBuilder( 'FauxResponse' )
 161                         ->setMethods( [ 'headersSent', 'setCookie', 'header' ] )
 162                         ->getMock();
 163                 $sentResponse->expects( $this->any() )->method( 'headersSent' )
 164                         ->will( $this->returnValue( true ) );
 165                 $sentResponse->expects( $this->never() )->method( 'setCookie' );
 166                 $sentResponse->expects( $this->never() )->method( 'header' );
 167
 168                 $sentRequest = $this->getMockBuilder( 'FauxRequest' )
 169                         ->setMethods( [ 'response' ] )->getMock();
 170                 $sentRequest->expects( $this->any() )->method( 'response' )
 171                         ->will( $this->returnValue( $sentResponse ) );
 172                 return $sentRequest;
 173         }
 174
 175         /**
 176          * @dataProvider providePersistSession
 177          * @param bool $secure
 178          * @param bool $remember
 179          */
 180         public function testPersistSession( $secure, $remember ) {
 181                 $this->setMwGlobals( [
 182                         'wgCookieExpiration' => 100,
 183                         'wgSecureLogin' => false,
 184                 ] );
 185
 186                 $provider = $this->getProvider( 'session' );
 187                 $provider->setLogger( new \Psr\Log\NullLogger() );
 188                 $priv = \TestingAccessWrapper::newFromObject( $provider );
 189                 $priv->sessionCookieOptions = [
 190                         'prefix' => 'x',
 191                         'path' => 'CookiePath',
 192                         'domain' => 'CookieDomain',
 193                         'secure' => false,
 194                         'httpOnly' => true,
 195                 ];
 196
 197                 $sessionId = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
 198                 $user = User::newFromName( 'UTSysop' );
 199                 $this->assertFalse( $user->requiresHTTPS(), 'sanity check' );
 200
 201                 $backend = new SessionBackend(
 202                         new SessionId( $sessionId ),
 203                         new SessionInfo( SessionInfo::MIN_PRIORITY, [
 204                                 'provider' => $provider,
 205                                 'id' => $sessionId,
 206                                 'persisted' => true,
 207                                 'userInfo' => UserInfo::newFromUser( $user, true ),
 208                                 'idIsSafe' => true,
 209                         ] ),
 210                         new TestBagOStuff(),
 211                         new \Psr\Log\NullLogger(),
 212                         10
 213                 );
 214                 \TestingAccessWrapper::newFromObject( $backend )->usePhpSessionHandling = false;
 215                 $backend->setRememberUser( $remember );
 216                 $backend->setForceHTTPS( $secure );
 217
 218                 // No cookie
 219                 $priv->sessionCookieName = null;
 220                 $request = new \FauxRequest();
 221                 $provider->persistSession( $backend, $request );
 222                 $this->assertSame( [], $request->response()->getCookies() );
 223
 224                 // Cookie
 225                 $priv->sessionCookieName = 'session';
 226                 $request = new \FauxRequest();
 227                 $time = time();
 228                 $provider->persistSession( $backend, $request );
 229
 230                 $cookie = $request->response()->getCookieData( 'xsession' );
 231                 $this->assertInternalType( 'array', $cookie );
 232                 if ( isset( $cookie['expire'] ) && $cookie['expire'] > 0 ) {
 233                         // Round expiry so we don't randomly fail if the seconds ticked during the test.
 234                         $cookie['expire'] = round( $cookie['expire'] - $time, -2 );
 235                 }
 236                 $this->assertEquals( [
 237                         'value' => $sessionId,
 238                         'expire' => null,
 239                         'path' => 'CookiePath',
 240                         'domain' => 'CookieDomain',
 241                         'secure' => $secure,
 242                         'httpOnly' => true,
 243                         'raw' => false,
 244                 ], $cookie );
 245
 246                 $cookie = $request->response()->getCookieData( 'forceHTTPS' );
 247                 if ( $secure ) {
 248                         $this->assertInternalType( 'array', $cookie );
 249                         if ( isset( $cookie['expire'] ) && $cookie['expire'] > 0 ) {
 250                                 // Round expiry so we don't randomly fail if the seconds ticked during the test.
 251                                 $cookie['expire'] = round( $cookie['expire'] - $time, -2 );
 252                         }
 253                         $this->assertEquals( [
 254                                 'value' => 'true',
 255                                 'expire' => null,
 256                                 'path' => 'CookiePath',
 257                                 'domain' => 'CookieDomain',
 258                                 'secure' => false,
 259                                 'httpOnly' => true,
 260                                 'raw' => false,
 261                         ], $cookie );
 262                 } else {
 263                         $this->assertNull( $cookie );
 264                 }
 265
 266                 // Headers sent
 267                 $request = $this->getSentRequest();
 268                 $provider->persistSession( $backend, $request );
 269                 $this->assertSame( [], $request->response()->getCookies() );
 270         }
 271
 272         public static function providePersistSession() {
 273                 return [
 274                         [ false, false ],
 275                         [ false, true ],
 276                         [ true, false ],
 277                         [ true, true ],
 278                 ];
 279         }
 280
 281         public function testUnpersistSession() {
 282                 $provider = $this->getProvider( 'session', '' );
 283                 $provider->setLogger( new \Psr\Log\NullLogger() );
 284                 $priv = \TestingAccessWrapper::newFromObject( $provider );
 285
 286                 // No cookie
 287                 $priv->sessionCookieName = null;
 288                 $request = new \FauxRequest();
 289                 $provider->unpersistSession( $request );
 290                 $this->assertSame( null, $request->response()->getCookie( 'session', '' ) );
 291
 292                 // Cookie
 293                 $priv->sessionCookieName = 'session';
 294                 $request = new \FauxRequest();
 295                 $provider->unpersistSession( $request );
 296                 $this->assertSame( '', $request->response()->getCookie( 'session', '' ) );
 297
 298                 // Headers sent
 299                 $request = $this->getSentRequest();
 300                 $provider->unpersistSession( $request );
 301                 $this->assertSame( null, $request->response()->getCookie( 'session', '' ) );
 302         }
 303
 304 }