Skip to content
Open
7 changes: 4 additions & 3 deletions .github/workflows/test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,9 @@ jobs:
strategy:
fail-fast: false
matrix:
php: [7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5]
runs-on: ubuntu-latest
php: ['7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5']
os: [ubuntu-latest, windows-latest, macos-latest]
runs-on: ${{ matrix.os }}
steps:
- name: Checkout repository
uses: actions/checkout@v4
Expand All @@ -17,7 +18,7 @@ jobs:
- uses: shivammathur/setup-php@v2
with:
php-version: ${{ matrix.php }}
extensions: curl, mbstring
extensions: curl, mbstring, pdo_sqlite, fileinfo
tools: composer:v2
- run: composer install
- run: composer test
9 changes: 5 additions & 4 deletions flight/net/UploadedFile.php
Original file line number Diff line number Diff line change
Expand Up @@ -131,14 +131,15 @@ public function moveTo(string $targetPath): void
throw new Exception($this->getUploadErrorMessage($this->error));
}

if (is_writeable(dirname($targetPath)) === false) {
throw new Exception('Target directory is not writable');
}

// Prevent path traversal attacks
if (strpos($targetPath, '..') !== false) {
throw new Exception('Invalid target path: contains directory traversal');
}

if (is_writeable(dirname($targetPath)) === false) {
throw new Exception('Target directory is not writable');
}

// Prevent absolute paths (basic check for Unix/Windows)
if ($targetPath[0] === '/' || (strlen($targetPath) > 1 && $targetPath[1] === ':')) {
throw new Exception('Invalid target path: absolute paths not allowed');
Expand Down
6 changes: 5 additions & 1 deletion tests/RenderTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,12 @@ public function testRenderView(): void
public function testRenderLayout(): void
{
$this->app->render('hello', ['name' => 'Bob'], 'content');
ob_start();
$this->app->render('layouts/layout');
$html = ob_get_clean();
$html = str_replace(["\r\n", "\n"], '', $html);
echo $html;

$this->expectOutputString("<body>Hello, Bob!</body>\n");
$this->expectOutputString("<body>Hello, Bob!</body>");
}
}
6 changes: 3 additions & 3 deletions tests/SimplePdoTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -171,9 +171,9 @@ public function testFetchRowDoesNotAddLimitAfterReturningClause(): void
$this->assertInstanceOf(Collection::class, $row);
$this->assertSame('Alice', $row['name']);
} catch (PDOException $exception) {
$this->assertSame(
'Prepare failed: near "RETURNING": syntax error',
$exception->getMessage(),
$this->assertStringContainsString(
'near "returning": syntax error',
strtolower($exception->getMessage()),
);
}
}
Expand Down
4 changes: 4 additions & 0 deletions tests/UploadedFileTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,10 @@ public function testMoveToOverwrite(): void

public function testMoveToSymlinkNonPost(): void
{
if (PHP_OS === 'WINNT') {
$this->markTestSkipped('Symbolic links require special privileges on Windows.');
}

file_put_contents('real_file', 'test');
if (file_exists('tmp_symlink')) {
unlink('tmp_symlink');
Expand Down
6 changes: 5 additions & 1 deletion tests/ViewTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -102,9 +102,13 @@ public function testTemplateWithCustomExtension(): void
$this->view->set('name', 'Bob');
$this->view->extension = '.html';

ob_start();
$this->view->render('world');
$html = ob_get_clean();
$html = str_replace(["\r\n", "\n"], '', $html);
echo $html;

$this->expectOutputString("Hello world, Bob!\n");
$this->expectOutputString("Hello world, Bob!");
}

public function testGetTemplateAbsolutePath(): void
Expand Down
4 changes: 2 additions & 2 deletions tests/commands/RouteCommandTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -123,8 +123,8 @@ public function testGetRoutes(): void
output; // phpcs:ignore

$this->assertStringContainsString(
str_replace(PHP_EOL, '', $expected),
str_replace(PHP_EOL, '', $this->removeColors(file_get_contents(static::$ou))),
str_replace(["\r\n", "\n"], '', $expected),
str_replace(["\r\n", "\n"], '', $this->removeColors(file_get_contents(static::$ou))),
);
}

Expand Down
Loading