mirror/Part-DB.Part-DB-server
1
0
Fork 1
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2025-06-20 17:15:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Escape not only the pathes of FileDTO objects returned by info providers but the preview image url too.

Browse source 
This fixes the second issue in #521
This commit is contained in:
Jan Böhmer 2024-03-05 22:52:27 +01:00
parent 925f5c0ce0
commit 113e5b3bcd
2 changed files with 77 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/Services/InfoProviderSystem/DTOs/SearchResultDTO.php
View file

@ -30,6 +30,11 @@ use App\Entity\Parts\ManufacturingStatus;
*/
class SearchResultDTO
{
/** @var string|null An URL to a preview image */
public readonly ?string $preview_image_url;
/** @var FileDTO|null The preview image as FileDTO object */
public readonly ?FileDTO $preview_image_file;
public function __construct(
/** @var string The provider key (e.g. "digikey") */
public readonly string $provider_key,
@ -46,7 +51,7 @@ class SearchResultDTO
/** @var string|null The manufacturer part number */
public readonly ?string $mpn = null,
/** @var string|null An URL to a preview image */
public readonly ?string $preview_image_url = null,
?string $preview_image_url = null,
/** @var ManufacturingStatus|null The manufacturing status of the part */
public readonly ?ManufacturingStatus $manufacturing_status = null,
/** @var string|null A link to the part on the providers page */
@ -55,5 +60,14 @@ class SearchResultDTO
public readonly ?string $footprint = null,
) {
if ($preview_image_url !== null) {
//Utilize the escaping mechanism of FileDTO to ensure that the preview image URL is correctly encoded
//See issue #521: https://github.com/Part-DB/Part-DB-server/issues/521
$this->preview_image_file = new FileDTO($preview_image_url);
$this->preview_image_url = $this->preview_image_file->url;
} else {
$this->preview_image_file = null;
$this->preview_image_url = null;
}
}
}

62
tests/Services/InfoProviderSystem/DTOs/SearchResultDTOTest.php Normal file
View file

@ -0,0 +1,62 @@
<?php
/*
* This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
*
* Copyright (C) 2019 - 2024 Jan Böhmer (https://github.com/jbtronics)
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published
* by the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
namespace App\Tests\Services\InfoProviderSystem\DTOs;
use App\Services\InfoProviderSystem\DTOs\SearchResultDTO;
use PHPUnit\Framework\TestCase;
class SearchResultDTOTest extends TestCase
{
public function testPreviewImageURL(): void
{
//For null preview_image_url, the url and file dto should be null
$searchResultDTO = new SearchResultDTO(
'provider_key',
'provider_id',
'name',
'description'
);
$this->assertNull($searchResultDTO->preview_image_url);
$this->assertNull($searchResultDTO->preview_image_file);
//If a value is passed then the url and file dto should be the same
$searchResultDTO = new SearchResultDTO(
'provider_key',
'provider_id',
'name',
'description',
preview_image_url: 'https://invalid.com/preview_image_url.jpg'
);
$this->assertEquals('https://invalid.com/preview_image_url.jpg', $searchResultDTO->preview_image_url);
$this->assertEquals('https://invalid.com/preview_image_url.jpg', $searchResultDTO->preview_image_file->url);
//Invalid url characters should be replaced with their URL encoded version (similar to FileDTO)
$searchResultDTO = new SearchResultDTO(
'provider_key',
'provider_id',
'name',
'description',
preview_image_url: 'https://invalid.com/preview_image^url.jpg?param1=1&param2=2'
);
$this->assertEquals('https://invalid.com/preview_image%5Eurl.jpg?param1=1&param2=2', $searchResultDTO->preview_image_url);
$this->assertEquals('https://invalid.com/preview_image%5Eurl.jpg?param1=1&param2=2', $searchResultDTO->preview_image_file->url);
}
}