Route parameters are URL-encoded - php

I'm trying out Lumen and I've written my first route:
$app->get('hello/{name}', function ($name) {
return "Hello, $name!";
});
The documentation I've read so far doesn't say a word about how the framework approaches HTML-injection so I made a quick test:
http://example.com/hello/<u>café
... which showed up like this:
Hello, %3Cu%3Ecaf%C3%A9!
In other words, route parameters are not URL-decoded when they reach my function. Other frameworks I've tried decode everything for you, just as if you were reading from $_GET.
Is there an issue with my set-up (Apache/2.4, mod_php and mod_rewrite with the default .htaccess bundled with the framework) or that's the expected input?

It's an intentional bug/feature (see Route parameters are URL-encoded #238 for reference). No idea about the rationale behind the design decision.

Related

Laravel 5.3 has the testing method onPage been removed?

I'm following through a video series on Laracasts to help me understand how to run tests in Laravel.
The test described is:
$this->visit('/')
->type('some query', '#term')
->press('Search')
->see('Search results for "some query"')
->onPage('search-results');
However Laravel complains that onPage is not a valid method. I've looked through the docs but can't seem to find a change which best describes what alternative method to use.
I tried to do:
$this->visit('/')
->type('some query', '#term')
->press('Search')
->visit('/search-results')
->see('Search results for "some query"');
But it seems that the behaviour of that is to redirect to /search-results before the form submits, meaning the output message is not the same and the assertion fails.
You can use seePageIs method.
Source code
Assert that the current page matches a given URI.
You can see more tips at the docs.
Seems like the method was removed. I think you can use $this->seePageIs() instead
https://github.com/laravel/framework/blob/5.3/src/Illuminate/Foundation/Testing/Concerns/InteractsWithPages.php#L176

Redirect::away(...) equivalent for Lumen?

I'm attempting to port a portion of a Laravel 4 app to Lumen, but I'm unable to figure out the equivalent of Laravel 4's Redirect::away(...); function for Lumen.
I've tried keeping it the same which doesn't work. I've also tried return redirect()->away($location); as suggested in a similar question I found, but that also fails with the error Call to undefined method Laravel\Lumen\Http\Redirector::away().
I feel like the answer to this is really simple, but unfortunately it's not documented anywhere and I can't figure out the right combination of things to get it to work.
My fallback is to use header('Location : '.$location); but would prefer to avoid it if there's a built in way to do it.
You should be fine to do return redirect($location) in most cases.
See https://medium.com/#zwacky/laravel-redirect-to-vs-redirect-away-dd875579951f for the minor differences (it'll trim() your URL and check that it's valid).

Url Variables with %2f not handled by silex

I am very new to silex, but have experience with Java based MVC frameworks.
The problem I have seems to be how to accept certain special characters in URL arguments.
I have a controller defined as such:
$app->get('/editPage/{fileName}', function ($fileName) use ($app,$action) {
return $app['twig']->render('edit.twig.html',$action->editPage($fileName));
});
and this works great for urls like:
/myapp/editPage/file.html
/myapp/editPage/file-2.html
but if I pass an encodes "/" or %2F, the route is not picked up, and I get a 404.
1. /myapp/editPage/folder%2Ffile.html
The mod_rewrites rules should route any non-existent file paths to the index.php where silex is defined, so I am not sure what is happening.
I just need a way to capture values with "/" for this particular page. There are no conflicting childpages, so if there is a way to wildcard the path "/editPage/{.*|filename}/" or something obvious I am missing.
You can use assert to change the regex that is used to match the variable. If you want it to match anything, pass a very lenient regex.
eg.
$app = new \Silex\Application();
$app->get('/file/{filename}', function ($filename) {
die(var_dump($filename));
})->assert('filename', '.*');
$app->run();
These requests
GET /file/a%2fb%2fc.txt
GET /file/a/b/c.txt
both yield
string 'a/b/c.txt' (length=9)
It's not an issue with Silex but with Apache.
Apache rejects by design encoded slashes as part of the URI for security purposes. See this answer: https://stackoverflow.com/a/12993237/358813
As a workaround passing the value inside a query string is completely fine:
http://example.com/?file=%2Fpath%2Fto%2Ffile will work, provided you configure Silex accordingly.
In addition to #tacone answer's, here's how I configured Silex to make it work.
I guess it's not the prettiest solution however...
The URL called should be /get/?url=<url encoded>
$siController->get('/get/', function(Application $app, $url){
/** #var SocialIdentifier $si */
$si = $app['social_identifier.social_identifier'];
$result = $si->get($url);
return $app->json($result, 200);
})
->value('url', $_GET['url']);

Yii - CHttpRequesterror while functional unittesting in module

When I'm trying to execute a functional unittest of a module within my Yii code, I keep receiving the following error:
CException: CHttpRequest is unable to determine the request URI.
At first, I though it was because it couldn't find the module. However, If I change the url to a wrong one, I get a correct error,s tating it couldn't find the view.
This is how my testing code looks like
public function testViewControllerModule()
{
ob_start();
Yii::app()->runController('module/controller/view');
}
Any ideas on what I might be missing?
bool.devs answer works so far.
This blog post explains the origin of the exception pretty well:
http://mattmccormick.ca/2012/09/14/unit-testing-url-routes-in-yii-framework/
In my case, I generalized the solution and have set the following variables in /www/protected/tests/bootstrap.php:
...
$_SERVER['SCRIPT_FILENAME'] = 'index-test.php';
$_SERVER['SCRIPT_NAME'] = '/index-test.php';
$_SERVER['REQUEST_URI'] = 'index-test.php';
Yii::createWebApplication($config);
Consider using 'index-test.php' instead of 'index.php' because it contains the config 'test.php' which is responsible for fixtures and maybe other test relevated configurations.
If someone has better suggestions feel free to comment :)
Kind regards
I think it's because you haven't set any server variables, i.e $_SERVER and you might be doing something like this in your controller:
Yii::app()->request ....
So before you run your test, make sure you use a fixture for the server variables also. I think this should suffice for now:
$_SERVER=array(
'REQUEST_URI'=>'index.php', // the other fields should follow
);
However to run functional tests i would recommend using SeleniumRC, you won't have to do these workarounds then, and can simulate user clicks also, i think.
Read the initial guide to Functional Testing , read the selenium rc phpunit guide, and also the CWebTestCase documentation.
Notes: You might still have to use fixtures for some variables, and i don't have much experience in testing(which is bad), so i'm not very sure if i am completely correct about selenium.

Rails style URL mapping in PHP

Is there any standard library to do Rails style URL mapping in PHP? I am not using any framework, all the code is hand-written. Basically, I am looking for a library that does this
example.com/user/1/active
this should map to a user, with id = 1 and status = 2 (those being the parameters). I should be able to define the map.
There are roughly ten thousand ways to do this in PHP.
I've recently become a fan of klein.php, a lightweight bit of router code with some handy convenience methods. It's not a framework, and doesn't get in the way of you using one if you wanted to.
It's basically little more than "here's a URL pattern, and here's the function to run when the pattern matches."
Frameworks are really built to handle that automatically, but short of using a framework, you would be best off writing your own .htaccess rules (if you are using linux or os x), or try checking out how say, CakePHP handles url rewriting and base off of that.
Example:
http://example.com/name/corey
RewriteRule ^(.+)/(.+)$ /$1.php?name=$2 [NC,L]
That would rewrite the above url to /name.php?name=corey
PHP's purpose is not to handle differently formatted URLs. There should be some custom application logic taking care of this.
You've mentioned that you are not using any framework at this moment, so I would like to propose you to include Silex, it's a micro framework based on the components of Symfony 2.
Here's the 'Hello World' example:
require_once __DIR__.'/silex.phar';
$app = new Silex\Application();
$app->get('/hello/{name}', function($name) use($app) {
return 'Hello '.$app->escape($name);
});
$app->run();
You've mentioned that you are currently using PHP 5.2. Silex uses namespaces, which are available from PHP 5.3 and so on, so you will have to upgrade your PHP to take this approach.
Go with Symfony framework.
http://symfony.com/blog/new-in-symfony-1-2-toward-a-restful-architecture-part-1
Look at this response:
https://stackoverflow.com/questions/238125/best-framework-for-php-and-creation-of-restful-based-web-services

Categories