mirror of
https://github.com/Vateron-Media/XC_VM.git
synced 2026-11-07 11:03:41 +01:00
babasado
f53d202970
Important security fix: reject missing or changed serials and locked device identities even in debug mode. Serialize binding checks, read current database state, and preserve existing serials during profile updates. Add an opt-in portal User-Agent allowlist with explicit approval of observed headers. Include reversible schema migration and regression coverage.
34 lines
1.3 KiB
PHP
34 lines
1.3 KiB
PHP
<?php
|
|
|
|
use PHPUnit\Framework\TestCase;
|
|
use XcVm\Domain\Device\DeviceUserAgentPolicy;
|
|
|
|
final class DeviceUserAgentPolicyTest extends TestCase {
|
|
public function testDisabledLockLeavesExistingClientsUnaffected(): void {
|
|
$this->assertTrue(DeviceUserAgentPolicy::allows([], ''));
|
|
}
|
|
|
|
public function testLockedPolicyRequiresAnExactNonemptyAllowlist(): void {
|
|
foreach (['[]', 'invalid json', '{}', '[null]', '["Player\\nInjected"]'] as $rList) {
|
|
$this->assertFalse(DeviceUserAgentPolicy::allows(['lock_user_agent' => 1, 'allowed_user_agents' => $rList], 'Player'));
|
|
}
|
|
$rPolicy = ['lock_user_agent' => 1, 'allowed_user_agents' => '["Player/1.0"]'];
|
|
$this->assertTrue(DeviceUserAgentPolicy::allows($rPolicy, 'Player/1.0'));
|
|
$this->assertFalse(DeviceUserAgentPolicy::allows($rPolicy, 'player/1.0'));
|
|
$this->assertFalse(DeviceUserAgentPolicy::allows($rPolicy, 'Player/1.0 extra'));
|
|
}
|
|
|
|
public function testHeaderObservationRejectsArraysAndControlCharacters(): void {
|
|
$rPrevious = $_SERVER['HTTP_USER_AGENT'] ?? null;
|
|
try {
|
|
foreach ([['Player'], "Player\nInjected", str_repeat('x', 1025)] as $rValue) {
|
|
$_SERVER['HTTP_USER_AGENT'] = $rValue;
|
|
$this->assertSame('', DeviceUserAgentPolicy::observed());
|
|
}
|
|
} finally {
|
|
if ($rPrevious === null) { unset($_SERVER['HTTP_USER_AGENT']); }
|
|
else { $_SERVER['HTTP_USER_AGENT'] = $rPrevious; }
|
|
}
|
|
}
|
|
}
|