Skip to content

Commit

Permalink
style(routing): Fix PHPCS errors
Browse files Browse the repository at this point in the history
  • Loading branch information
klausi committed Nov 8, 2023
1 parent 2376520 commit f12daab
Show file tree
Hide file tree
Showing 2 changed files with 34 additions and 20 deletions.
10 changes: 7 additions & 3 deletions src/Routing/QueryRouteEnhancer.php
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ protected function assertValidPostRequestHeaders(Request $request) : void {
return;
}

/** @phpstan-ignore-next-line */
// @phpstan-ignore-next-line
$content_format = method_exists($request, 'getContentTypeFormat') ? $request->getContentTypeFormat() : $request->getContentType();
if ($content_format === NULL) {
// Symfony before 5.4 does not detect "multipart/form-data", check for it
Expand All @@ -116,7 +116,11 @@ protected function assertValidPostRequestHeaders(Request $request) : void {
if ($content_format === "form") {
// If the client set a custom header then we can be sure CORS was
// respected.
$custom_headers = ['Apollo-Require-Preflight', 'X-Apollo-Operation-Name', 'x-graphql-yoga-csrf'];
$custom_headers = [
'Apollo-Require-Preflight',
'X-Apollo-Operation-Name',
'x-graphql-yoga-csrf',
];
foreach ($custom_headers as $custom_header) {
if ($request->headers->has($custom_header)) {
return;
Expand All @@ -133,7 +137,7 @@ protected function assertValidPostRequestHeaders(Request $request) : void {
if (!empty($this->corsOptions['enabled'])) {
$cors_service = new CorsService($this->corsOptions);
// Drupal 9 compatibility, method name has changed in Drupal 10.
/** @phpstan-ignore-next-line */
// @phpstan-ignore-next-line
if ($cors_service->isActualRequestAllowed($request)) {
return;
}
Expand Down
44 changes: 27 additions & 17 deletions tests/src/Kernel/Framework/CsrfTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -155,26 +155,36 @@ public function provideAllowedFormRequests(): array {
[['CONTENT_TYPE' => 'multipart/form-data']],
// The custom Apollo-Require-Preflight header overrules any evil Origin
// header.
[[
'CONTENT_TYPE' => 'multipart/form-data',
'HTTP_APOLLO_REQUIRE_PREFLIGHT' => 'test',
'HTTP_ORIGIN' => 'https://evil.example.com',
]],
[
[
'CONTENT_TYPE' => 'multipart/form-data',
'HTTP_APOLLO_REQUIRE_PREFLIGHT' => 'test',
'HTTP_ORIGIN' => 'https://evil.example.com',
],
],
// The Origin header alone with the correct domain is allowed.
[[
'CONTENT_TYPE' => 'multipart/form-data',
'HTTP_ORIGIN' => 'https://example.com',
]],
[
[
'CONTENT_TYPE' => 'multipart/form-data',
'HTTP_ORIGIN' => 'https://example.com',
],
],
// The Origin header with an allowed domain.
[[
'CONTENT_TYPE' => 'multipart/form-data',
'HTTP_ORIGIN' => 'https://allowed.example.com',
], ['https://allowed.example.com']],
[
[
'CONTENT_TYPE' => 'multipart/form-data',
'HTTP_ORIGIN' => 'https://allowed.example.com',
],
['https://allowed.example.com'],
],
// The Origin header with any allowed domain.
[[
'CONTENT_TYPE' => 'multipart/form-data',
'HTTP_ORIGIN' => 'https://allowed.example.com',
], ['*']],
[
[
'CONTENT_TYPE' => 'multipart/form-data',
'HTTP_ORIGIN' => 'https://allowed.example.com',
],
['*'],
],
];
}

Expand Down

0 comments on commit f12daab

Please sign in to comment.