resourceloader: Validate ResourceLoaderContext::getDirection() input

Only dir=ltr and dir=rtl are now allowed. Ignore other values.

Change-Id: Id39471e8a792c7c48ff7ca9d80be2e6dd4caee6b

diff --git a/includes/resourceloader/ResourceLoaderContext.php b/includes/resourceloader/ResourceLoaderContext.php
index c596a23..f57f13b 100644 (file)
--- a/includes/resourceloader/ResourceLoaderContext.php
+++ b/includes/resourceloader/ResourceLoaderContext.php
@@ -190,8 +190,10 @@ class ResourceLoaderContext implements MessageLocalizer {
         */
        public function getDirection() {
                if ( $this->direction === null ) {
-                       $this->direction = $this->getRequest()->getRawVal( 'dir' );
-                       if ( !$this->direction ) {
+                       $direction = $this->getRequest()->getRawVal( 'dir' );
+                       if ( $direction === 'ltr' || $direction === 'rtl' ) {
+                               $this->direction = $direction;
+                       } else {
                                // Determine directionality based on user language (T8100)
                                $this->direction = Language::factory( $this->getLanguage() )->getDir();
                        }

diff --git a/tests/phpunit/includes/resourceloader/ResourceLoaderContextTest.php b/tests/phpunit/includes/resourceloader/ResourceLoaderContextTest.php
index 2ec8ea9..c3d5ec1 100644 (file)
--- a/tests/phpunit/includes/resourceloader/ResourceLoaderContextTest.php
+++ b/tests/phpunit/includes/resourceloader/ResourceLoaderContextTest.php
@@ -78,6 +78,38 @@ class ResourceLoaderContextTest extends PHPUnit\Framework\TestCase {
                $this->assertEquals( 'zh|fallback|||styles|||||', $ctx->getHash() );
        }
 
+       public static function provideDirection() {
+               yield 'LTR language' => [
+                       [ 'lang' => 'en' ],
+                       'ltr',
+               ];
+               yield 'RTL language' => [
+                       [ 'lang' => 'he' ],
+                       'rtl',
+               ];
+               yield 'explicit LTR' => [
+                       [ 'lang' => 'he', 'dir' => 'ltr' ],
+                       'ltr',
+               ];
+               yield 'explicit RTL' => [
+                       [ 'lang' => 'en', 'dir' => 'rtl' ],
+                       'rtl',
+               ];
+               // Not supported, but tested to cover the case and detect change
+               yield 'invalid dir' => [
+                       [ 'lang' => 'he', 'dir' => 'xyz' ],
+                       'rtl',
+               ];
+       }
+
+       /**
+        * @dataProvider provideDirection
+        */
+       public function testDirection( array $params, $expected ) {
+               $ctx = new ResourceLoaderContext( $this->getResourceLoader(), new FauxRequest( $params ) );
+               $this->assertEquals( $expected, $ctx->getDirection() );
+       }
+
        public function testShouldInclude() {
                $ctx = new ResourceLoaderContext( $this->getResourceLoader(), new FauxRequest( [] ) );
                $this->assertTrue( $ctx->shouldIncludeScripts(), 'Scripts in combined' );