OXIESEC PANEL

Name	Size	Modified	Perms
📁 ..	-	08/12/2024 10:33:53 AM	rwxr-xr-x
📄 BucketLockRetentionPolicyTest.php	1.72 KB	08/12/2024 10:33:52 AM	rw-r--r--
📄 BucketRpoTest.php	2.44 KB	08/12/2024 10:33:52 AM	rw-r--r--
📄 HmacKeyTest.php	4.84 KB	08/12/2024 10:33:52 AM	rw-r--r--
📄 HoldObjectsTest.php	1.7 KB	08/12/2024 10:33:52 AM	rw-r--r--
📄 IamConfigurationTest.php	7.52 KB	08/12/2024 10:33:52 AM	rw-r--r--
📄 IamTest.php	3.71 KB	08/12/2024 10:33:52 AM	rw-r--r--
📄 KmsTest.php	5.45 KB	08/12/2024 10:33:52 AM	rw-r--r--
📄 ManageAclTest.php	2.25 KB	08/12/2024 10:33:52 AM	rw-r--r--
📄 ManageBucketsTest.php	16.3 KB	08/12/2024 10:33:52 AM	rw-r--r--
📄 ManageNotificationsTest.php	1.9 KB	08/12/2024 10:33:53 AM	rw-r--r--
📄 ManageObjectsTest.php	16.28 KB	08/12/2024 10:33:53 AM	rw-r--r--
📄 PostPolicyTest.php	4.49 KB	08/12/2024 10:33:53 AM	rw-r--r--
📄 README.md	835 bytes	08/12/2024 10:33:53 AM	rw-r--r--
📄 RequesterPaysTest.php	15.14 KB	08/12/2024 10:33:53 AM	rw-r--r--
📄 SignedUrlTest.php	7.93 KB	08/12/2024 10:33:53 AM	rw-r--r--
📄 StorageTestCase.php	2.5 KB	08/12/2024 10:33:53 AM	rw-r--r--
📁 StreamWrapper	-	08/12/2024 10:35:02 AM	rwxr-xr-x
📄 UploadObjectsTest.php	4.7 KB	08/12/2024 10:33:53 AM	rw-r--r--
📄 bootstrap.php	180 bytes	08/12/2024 10:33:52 AM	rw-r--r--
📁 data	-	08/12/2024 10:35:01 AM	rwxr-xr-x

Editing: PostPolicyTest.php

<?php
/**
 * Copyright 2020 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

namespace Google\Cloud\Storage\Tests\System;

use GuzzleHttp\Client;
use GuzzleHttp\Psr7\Utils;

/**
 * @group storage
 * @group storage-postpolicy
 */
class PostPolicyTest extends StorageTestCase
{
    private $guzzle;

public function setUp(): void
    {
        $this->guzzle = new Client;
    }

public function testUploadPolicy()
    {
        $filename = $this->createFilename();
        $content = 'helloworld';
        $policy = self::$bucket->generateSignedPostPolicyV4($filename, time() + 3600);
        $res = $this->uploadWithPolicy($policy, $content);
        self::$deletionQueue->add($this->getObject($filename));

$this->assertEquals(204, $res->getStatusCode());
        $this->assertEquals($content, $this->getUploadedFileContents($filename));
    }

public function testUploadPolicySuccessActionRedirect()
    {
        $filename = $this->createFilename();
        $content = 'helloworld';
        $location = 'https://google.com';
        $policy = self::$bucket->generateSignedPostPolicyV4($filename, time() + 3600, [
            'fields' => [
                'success_action_redirect' => $location
            ]
        ]);
        $res = $this->uploadWithPolicy($policy, $content);
        self::$deletionQueue->add($this->getObject($filename));

$this->assertEquals(303, $res->getStatusCode());
        $this->assertStringStartsWith(
            $location . '?bucket=' . self::$bucket->name(),
            $res->getHeaderLine('Location')
        );
    }

public function testUploadPolicyInvalidField()
    {
        $filename = $this->createFilename();
        $policy = self::$bucket->generateSignedPostPolicyV4($filename, time() + 3600, [
            'fields' => [
                'x-goog-random' => 'foo'
            ]
        ]);
        $res = $this->uploadWithPolicy($policy);
        self::$deletionQueue->add($this->getObject($filename));

$this->assertEquals(400, $res->getStatusCode());
    }

/**
     * @dataProvider escapingSequences
     */
    public function testUploadPolicyEscapingSequence($cond)
    {
        $filename = $this->createFilename();
        $policy = self::$bucket->generateSignedPostPolicyV4($filename, time() + 3600, [
            'conditions' => [
                ['x-goog-meta-foo' => $cond]
            ],
            'fields' => [
                'x-goog-meta-foo' => $cond
            ]
        ]);
        $res = $this->uploadWithPolicy($policy);
        self::$deletionQueue->add($this->getObject($filename));

$this->assertGreaterThanOrEqual(200, (int)$res->getStatusCode());
        $this->assertLessThan(300, (int)$res->getStatusCode());
    }

public function escapingSequences()
    {
        return [
            ["foo
            "],
            ["é"],
            ["hello\world"],
            ["	"] // tab
        ];
    }

private function uploadWithPolicy(array $policy, $content = '')
    {
        $fields = [];
        $fields[] = [
            'name' => 'file',
            'contents' => Utils::streamFor($content ?: uniqid(self::TESTING_PREFIX))
        ];

foreach ($policy['fields'] as $key => $val) {
            $fields[] = [
                'name' => $key,
                'contents' => $val
            ];
        }

return $this->guzzle->request('POST', $policy['url'], [
            'multipart' => $fields,
            'allow_redirects' => false,
            'http_errors' => false
        ]);
    }

private function getUploadedFileContents($filename)
    {
        $object = self::$bucket->object($filename);
        return $object->downloadAsString();
    }

private function getObject($filename)
    {
        return self::$bucket->object($filename);
    }

private function createFilename()
    {
        return uniqid(self::TESTING_PREFIX) . '.txt';
    }
}