bert.hausmans/crewli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: comprehensive security regression test suite

Browse Source 
61 tests across 4 test files covering all OWASP categories:

MultiTenancyIsolationTest (19 tests):
- Cross-org event, person, shift, section, time-slot, location,
  registration field, shift assignment, crowd list access
- Cross-org FK references (crowd_type, company, parent_event)
- Bulk operation isolation, invitation revocation
- Portal cross-event access prevention

AuthenticationSecurityTest (15 tests):
- Rate limiting: login (5/min), portal token-auth (10/min),
  invitation show (10/min)
- Account enumeration prevention: generic error on failed login,
  200 response on password reset for unknown email
- Token lifecycle: logout revokes token, password reset revokes
  all tokens, expired tokens rejected (7-day config verified)
- Password strength: weak/no-uppercase/no-numbers rejected
- Security headers present on all responses
- Protected routes require authentication

PortalTokenSecurityTest (10 tests):
- Invalid/empty/missing token handling
- Response shape: only safe fields (no milestones, no portal_token,
  no organisation_id, no internal event fields)
- Hash-based lookup: plain token works, hash does not
- Error messages: no schema/table info leakage
- Middleware: rejects without token, rejects invalid, accepts valid,
  rejects draft event status

InputValidationSecurityTest (17 tests):
- XSS payloads stored safely in person name, event name, section name
- Oversized inputs rejected (name >255, remarks >5000)
- Invalid enum values rejected (status, event_type)
- Cross-org FK references rejected (crowd_type, company, location,
  parent_event, person assignment)
- Invalid/nonexistent ULID format rejected
- SQL injection payloads harmless (PDO binding verified)

Also fixes PortalTokenMiddleware to use request->attributes->set()
instead of request->merge() for stdClass objects.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
bert.hausmans
2026-04-14 07:25:47 +02:00
parent b8286d6a84
commit 51e5dd6fcb
5 changed files with 944 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

367
api/tests/Feature/Security/InputValidationSecurityTest.php Normal file
View File

@@ -0,0 +1,367 @@
<?php
declare(strict_types=1);
namespace Tests\Feature\Security;
use App\Models\Company;
use App\Models\CrowdType;
use App\Models\Event;
use App\Models\FestivalSection;
use App\Models\Location;
use App\Models\Organisation;
use App\Models\Person;
use App\Models\Shift;
use App\Models\TimeSlot;
use App\Models\User;
use Database\Seeders\RoleSeeder;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Laravel\Sanctum\Sanctum;
use Tests\TestCase;
final class InputValidationSecurityTest extends TestCase
{
use RefreshDatabase;
private Organisation $organisation;
private Event $event;
private User $admin;
private CrowdType $crowdType;
protected function setUp(): void
{
parent::setUp();
$this->seed(RoleSeeder::class);
$this->organisation = Organisation::factory()->create();
$this->admin = User::factory()->create();
$this->organisation->users()->attach($this->admin, ['role' => 'org_admin']);
$this->crowdType = CrowdType::factory()->systemType('VOLUNTEER')->create([
'organisation_id' => $this->organisation->id,
]);
$this->event = Event::factory()->create([
'organisation_id' => $this->organisation->id,
'status' => 'registration_open',
]);
}
// --- XSS Payload Storage ---
public function test_xss_in_person_name_is_stored_safely(): void
{
Sanctum::actingAs($this->admin);
$xssPayload = '<script>alert("xss")</script>';
$response = $this->postJson("/api/v1/events/{$this->event->id}/persons", [
'crowd_type_id' => $this->crowdType->id,
'first_name' => $xssPayload,
'last_name' => 'Normal',
'email' => 'xss-test@example.com',
]);
$response->assertCreated();
// Value is stored as-is (Laravel escapes on output via {{ }})
$this->assertDatabaseHas('persons', [
'first_name' => $xssPayload,
'email' => 'xss-test@example.com',
]);
// API resource should return the raw string (Vue's {{ }} escapes it)
$response->assertJsonPath('data.first_name', $xssPayload);
}
public function test_xss_in_event_name_is_stored_safely(): void
{
Sanctum::actingAs($this->admin);
$xssPayload = '"><img src=x onerror=alert(1)>';
$response = $this->postJson("/api/v1/organisations/{$this->organisation->id}/events", [
'name' => $xssPayload,
'slug' => 'xss-test-event',
'start_date' => '2026-07-01',
'end_date' => '2026-07-03',
]);
$response->assertCreated();
$response->assertJsonPath('data.name', $xssPayload);
}
public function test_xss_in_section_name_is_stored_safely(): void
{
Sanctum::actingAs($this->admin);
$xssPayload = '<svg onload=alert(1)>';
$response = $this->postJson("/api/v1/events/{$this->event->id}/sections", [
'name' => $xssPayload,
]);
$response->assertCreated();
$response->assertJsonPath('data.name', $xssPayload);
}
// --- Oversized Input Rejection ---
public function test_oversized_person_name_rejected(): void
{
Sanctum::actingAs($this->admin);
$response = $this->postJson("/api/v1/events/{$this->event->id}/persons", [
'crowd_type_id' => $this->crowdType->id,
'first_name' => str_repeat('A', 256),
'last_name' => 'Normal',
'email' => 'oversize@example.com',
]);
$response->assertUnprocessable();
$response->assertJsonValidationErrors('first_name');
}
public function test_oversized_event_name_rejected(): void
{
Sanctum::actingAs($this->admin);
$response = $this->postJson("/api/v1/organisations/{$this->organisation->id}/events", [
'name' => str_repeat('A', 256),
'slug' => 'oversize-test',
'start_date' => '2026-07-01',
'end_date' => '2026-07-03',
]);
$response->assertUnprocessable();
$response->assertJsonValidationErrors('name');
}
public function test_oversized_remarks_rejected(): void
{
Sanctum::actingAs($this->admin);
$response = $this->postJson("/api/v1/events/{$this->event->id}/persons", [
'crowd_type_id' => $this->crowdType->id,
'first_name' => 'Test',
'last_name' => 'User',
'email' => 'remarks@example.com',
'remarks' => str_repeat('A', 5001),
]);
$response->assertUnprocessable();
$response->assertJsonValidationErrors('remarks');
}
// --- Invalid Enum Values ---
public function test_invalid_event_status_rejected(): void
{
Sanctum::actingAs($this->admin);
$response = $this->postJson("/api/v1/organisations/{$this->organisation->id}/events", [
'name' => 'Enum Test',
'slug' => 'enum-test',
'start_date' => '2026-07-01',
'end_date' => '2026-07-03',
'status' => 'hacked_status',
]);
$response->assertUnprocessable();
$response->assertJsonValidationErrors('status');
}
public function test_invalid_person_status_rejected(): void
{
Sanctum::actingAs($this->admin);
$response = $this->postJson("/api/v1/events/{$this->event->id}/persons", [
'crowd_type_id' => $this->crowdType->id,
'first_name' => 'Test',
'last_name' => 'User',
'email' => 'enum@example.com',
'status' => 'superadmin',
]);
$response->assertUnprocessable();
$response->assertJsonValidationErrors('status');
}
public function test_invalid_event_type_rejected(): void
{
Sanctum::actingAs($this->admin);
$response = $this->postJson("/api/v1/organisations/{$this->organisation->id}/events", [
'name' => 'Type Test',
'slug' => 'type-test',
'start_date' => '2026-07-01',
'end_date' => '2026-07-03',
'event_type' => 'malicious',
]);
$response->assertUnprocessable();
$response->assertJsonValidationErrors('event_type');
}
// --- Cross-Org Foreign Key Validation ---
public function test_person_with_cross_org_crowd_type_rejected(): void
{
$otherOrg = Organisation::factory()->create();
$otherCrowdType = CrowdType::factory()->create(['organisation_id' => $otherOrg->id]);
Sanctum::actingAs($this->admin);
$response = $this->postJson("/api/v1/events/{$this->event->id}/persons", [
'crowd_type_id' => $otherCrowdType->id,
'first_name' => 'FK',
'last_name' => 'Test',
'email' => 'fk@example.com',
]);
$response->assertUnprocessable();
$response->assertJsonValidationErrors('crowd_type_id');
}
public function test_person_with_cross_org_company_rejected(): void
{
$otherOrg = Organisation::factory()->create();
$otherCompany = Company::factory()->create(['organisation_id' => $otherOrg->id]);
Sanctum::actingAs($this->admin);
$response = $this->postJson("/api/v1/events/{$this->event->id}/persons", [
'crowd_type_id' => $this->crowdType->id,
'first_name' => 'Company',
'last_name' => 'Test',
'email' => 'company-fk@example.com',
'company_id' => $otherCompany->id,
]);
$response->assertUnprocessable();
$response->assertJsonValidationErrors('company_id');
}
public function test_shift_with_cross_event_location_rejected(): void
{
$otherEvent = Event::factory()->create(['organisation_id' => $this->organisation->id]);
$otherLocation = Location::factory()->create(['event_id' => $otherEvent->id]);
$section = FestivalSection::factory()->create(['event_id' => $this->event->id]);
$timeSlot = TimeSlot::factory()->create(['event_id' => $this->event->id]);
Sanctum::actingAs($this->admin);
$response = $this->postJson(
"/api/v1/events/{$this->event->id}/sections/{$section->id}/shifts",
[
'time_slot_id' => $timeSlot->id,
'location_id' => $otherLocation->id,
'slots_total' => 5,
'slots_open_for_claiming' => 3,
]
);
$response->assertUnprocessable();
$response->assertJsonValidationErrors('location_id');
}
public function test_event_with_cross_org_parent_rejected(): void
{
$otherOrg = Organisation::factory()->create();
$otherEvent = Event::factory()->create(['organisation_id' => $otherOrg->id]);
Sanctum::actingAs($this->admin);
$response = $this->postJson("/api/v1/organisations/{$this->organisation->id}/events", [
'name' => 'Sub Event',
'slug' => 'sub-event-test',
'start_date' => '2026-07-01',
'end_date' => '2026-07-03',
'parent_event_id' => $otherEvent->id,
]);
$response->assertUnprocessable();
$response->assertJsonValidationErrors('parent_event_id');
}
public function test_assign_shift_with_cross_event_person_rejected(): void
{
$otherEvent = Event::factory()->create([
'organisation_id' => $this->organisation->id,
'status' => 'registration_open',
]);
$otherPerson = Person::factory()->approved()->create([
'event_id' => $otherEvent->id,
'crowd_type_id' => $this->crowdType->id,
]);
$section = FestivalSection::factory()->create(['event_id' => $this->event->id]);
$timeSlot = TimeSlot::factory()->create(['event_id' => $this->event->id]);
$shift = Shift::factory()->create([
'festival_section_id' => $section->id,
'time_slot_id' => $timeSlot->id,
]);
Sanctum::actingAs($this->admin);
$response = $this->postJson(
"/api/v1/events/{$this->event->id}/sections/{$section->id}/shifts/{$shift->id}/assign",
['person_id' => $otherPerson->id]
);
$response->assertUnprocessable();
$response->assertJsonValidationErrors('person_id');
}
// --- ULID Format Validation ---
public function test_invalid_ulid_format_rejected(): void
{
Sanctum::actingAs($this->admin);
$response = $this->postJson("/api/v1/events/{$this->event->id}/persons", [
'crowd_type_id' => 'not-a-valid-ulid',
'first_name' => 'Test',
'last_name' => 'User',
'email' => 'ulid@example.com',
]);
$response->assertUnprocessable();
$response->assertJsonValidationErrors('crowd_type_id');
}
public function test_nonexistent_ulid_rejected(): void
{
Sanctum::actingAs($this->admin);
$response = $this->postJson("/api/v1/events/{$this->event->id}/persons", [
'crowd_type_id' => '01JZZZZZZZZZZZZZZZZZZZZZZ',
'first_name' => 'Test',
'last_name' => 'User',
'email' => 'nonexistent@example.com',
]);
$response->assertUnprocessable();
$response->assertJsonValidationErrors('crowd_type_id');
}
// --- SQL Injection Resistance ---
public function test_sql_injection_in_string_fields_harmless(): void
{
Sanctum::actingAs($this->admin);
$sqlPayload = "'; DROP TABLE users; --";
$response = $this->postJson("/api/v1/events/{$this->event->id}/persons", [
'crowd_type_id' => $this->crowdType->id,
'first_name' => $sqlPayload,
'last_name' => 'Normal',
'email' => 'sql@example.com',
]);
$response->assertCreated();
// Table still exists
$this->assertDatabaseCount('users', 1); // the admin user
$this->assertDatabaseHas('persons', ['first_name' => $sqlPayload]);
}
}