Keith Solomon
d15dfc6835
PostTeamEditor interpolated the scenario id into a <script> block as
'localStorage.setItem("scenario:<id>", ...)', so an id containing
'</script><script>...</script>' would break out of the JS-string context
and execute in the browser. Use json_encode with JSON_HEX_TAG / HEX_AMP /
HEX_APOS / HEX_QUOT so the id is always a safe JS string literal.
Adds a PostTeamEditorTest case that submits '</script><script>alert(1)</script>'
and asserts the literal '<script>alert(1)</script>' substring is absent
from the response. Updates the existing happy-path and FullFlowTest
assertions to match the new 'scenario:"demo"' (quoted) form.
88 lines
2.9 KiB
PHP
88 lines
2.9 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace BattleForge\Http\Handlers;
|
|
|
|
use BattleForge\Application\ScenarioDraft;
|
|
use BattleForge\Domain\ScenarioValidator;
|
|
use BattleForge\Http\CsrfToken;
|
|
use BattleForge\Http\Escape;
|
|
use BattleForge\Http\Request;
|
|
use BattleForge\Http\Response;
|
|
|
|
final class PostTeamEditor
|
|
{
|
|
/** @param array<string, string> $params */
|
|
public function handle(Request $request, array $params): Response
|
|
{
|
|
$submitted = (string) ($request->post['_csrf'] ?? '');
|
|
$expected = (string) ($request->cookies['__csrf'] ?? '');
|
|
$secret = (string) ($request->server['__csrf_secret'] ?? '');
|
|
|
|
if ($secret === '' || $expected === '' || !CsrfToken::verify($submitted, $secret, $expected)) {
|
|
return Response::html(403, '<h1>Forbidden</h1>');
|
|
}
|
|
|
|
try {
|
|
$draft = ScenarioDraft::fromPost($request->post);
|
|
$scenario = $draft->toScenario();
|
|
ScenarioValidator::validate($scenario);
|
|
} catch (\InvalidArgumentException $exception) {
|
|
return $this->renderForm($request, $params['id'] ?? 'new', $request->cookies['__csrf'] ?? '', $exception->getMessage(), $request->post);
|
|
}
|
|
|
|
$json = json_encode($this->scenarioToArray($scenario), JSON_THROW_ON_ERROR);
|
|
$url = (string) ($params['id'] ?? $scenario->id);
|
|
$safeUrl = json_encode($url, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
|
|
$body = <<<HTML
|
|
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head><meta charset="utf-8"><title>Saved</title></head>
|
|
<body>
|
|
<p>Scenario saved.</p>
|
|
<script type="module">
|
|
localStorage.setItem('scenario:{$safeUrl}', $json);
|
|
</script>
|
|
</body>
|
|
</html>
|
|
HTML;
|
|
|
|
return Response::html(200, $body);
|
|
}
|
|
|
|
/** @param array<string, mixed> $post */
|
|
private function renderForm(Request $request, string $scenarioId, string $csrf, string $error, array $post): Response
|
|
{
|
|
$error = Escape::html($error);
|
|
$csrf = Escape::html($csrf);
|
|
$scenarioId = Escape::html($scenarioId);
|
|
|
|
$old = array_intersect_key($post, array_flip([
|
|
'id',
|
|
'name',
|
|
'battlefieldWidth',
|
|
'battlefieldHeight',
|
|
'victoryCondition',
|
|
'holdRoundsRequired',
|
|
]));
|
|
$old = array_map(static fn ($v): string => is_scalar($v) ? (string) $v : '', $old);
|
|
|
|
$teamA = $post['teamA']['units'] ?? [];
|
|
$teamB = $post['teamB']['units'] ?? [];
|
|
|
|
ob_start();
|
|
require_once __DIR__ . '/../../Views/layout.php';
|
|
require __DIR__ . '/../../Views/team-editor.php';
|
|
$body = (string) ob_get_clean();
|
|
|
|
return Response::html(200, $body);
|
|
}
|
|
|
|
/** @return array<string, mixed> */
|
|
private function scenarioToArray(\BattleForge\Domain\Scenario $scenario): array
|
|
{
|
|
return \BattleForge\Application\ScenarioSerializer::scenarioToArray($scenario);
|
|
}
|
|
}
|