Skip to content

Commit 194e247

Browse files
KevinBKozanKevinBKozan
authored
Merge pull request #3747 from magento-pangolin/MQE-1430-2
[pangolin] MQE-1430: [2.2.x] Limit allowed bin/magento commands to specific list (MTF)
2 parents 37ad124 + caa51e5 commit 194e247

18 files changed

+437
-156
lines changed

‎dev/tests/functional/lib/Magento/Mtf/Util/Command/Cli.php

Lines changed: 30 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88

99
use Magento\Mtf\Util\Protocol\CurlInterface;
1010
use Magento\Mtf\Util\Protocol\CurlTransport;
11+
use Magento\Mtf\Util\Protocol\CurlTransport\WebapiDecorator;
1112

1213
/**
1314
* Perform bin/magento commands from command line for functional tests executions.
@@ -17,7 +18,7 @@ class Cli
1718
/**
1819
* Url to command.php.
1920
*/
20-
const URL = 'dev/tests/functional/utils/command.php';
21+
const URL = '/dev/tests/functional/utils/command.php';
2122

2223
/**
2324
* Curl transport protocol.
@@ -26,12 +27,21 @@ class Cli
2627
*/
2728
private $transport;
2829

30+
/**
31+
* Webapi handler.
32+
*
33+
* @var WebapiDecorator
34+
*/
35+
private $webapiHandler;
36+
2937
/**
3038
* @param CurlTransport $transport
39+
* @param WebapiDecorator $webapiHandler
3140
*/
32-
public function __construct(CurlTransport $transport)
41+
public function __construct(CurlTransport $transport, WebapiDecorator $webapiHandler)
3342
{
3443
$this->transport = $transport;
44+
$this->webapiHandler = $webapiHandler;
3545
}
3646

3747
/**
@@ -43,22 +53,31 @@ public function __construct(CurlTransport $transport)
4353
*/
4454
public function execute($command, $options = [])
4555
{
46-
$curl = $this->transport;
47-
$curl->write($this->prepareUrl($command, $options), [], CurlInterface::GET);
48-
$curl->read();
49-
$curl->close();
56+
$this->transport->write(
57+
rtrim(str_replace('index.php', '', $_ENV['app_frontend_url']), '/') . self::URL,
58+
$this->prepareParamArray($command, $options),
59+
CurlInterface::POST,
60+
[]
61+
);
62+
$this->transport->read();
63+
$this->transport->close();
5064
}
5165

5266
/**
53-
* Prepare url.
67+
* Prepare parameter array.
5468
*
5569
* @param string $command
5670
* @param array $options [optional]
57-
* @return string
71+
* @return array
5872
*/
59-
private function prepareUrl($command, $options = [])
73+
private function prepareParamArray($command, $options = [])
6074
{
61-
$command .= ' ' . implode(' ', $options);
62-
return $_ENV['app_frontend_url'] . self::URL . '?command=' . urlencode($command);
75+
if (!empty($options)) {
76+
$command .= ' ' . implode(' ', $options);
77+
}
78+
return [
79+
'token' => urlencode($this->webapiHandler->getWebapiToken()),
80+
'command' => urlencode($command)
81+
];
6382
}
6483
}

‎dev/tests/functional/lib/Magento/Mtf/Util/Command/File/Export/Reader.php

Lines changed: 29 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6-
76
namespace Magento\Mtf\Util\Command\File\Export;
87

98
use Magento\Mtf\ObjectManagerInterface;
109
use Magento\Mtf\Util\Protocol\CurlTransport;
1110
use Magento\Mtf\Util\Protocol\CurlInterface;
11+
use Magento\Mtf\Util\Protocol\CurlTransport\WebapiDecorator;
1212

1313
/**
1414
* File reader for Magento export files.
@@ -36,16 +36,29 @@ class Reader implements ReaderInterface
3636
*/
3737
private $transport;
3838

39+
/**
40+
* Webapi handler.
41+
*
42+
* @var WebapiDecorator
43+
*/
44+
private $webapiHandler;
45+
3946
/**
4047
* @param ObjectManagerInterface $objectManager
4148
* @param CurlTransport $transport
49+
* @param WebapiDecorator $webapiHandler
4250
* @param string $template
4351
*/
44-
public function __construct(ObjectManagerInterface $objectManager, CurlTransport $transport, $template)
45-
{
52+
public function __construct(
53+
ObjectManagerInterface $objectManager,
54+
CurlTransport $transport,
55+
WebapiDecorator $webapiHandler,
56+
$template
57+
) {
4658
$this->objectManager = $objectManager;
4759
$this->template = $template;
4860
$this->transport = $transport;
61+
$this->webapiHandler = $webapiHandler;
4962
}
5063

5164
/**
@@ -70,20 +83,27 @@ public function getData()
7083
*/
7184
private function getFiles()
7285
{
73-
$this->transport->write($this->prepareUrl(), [], CurlInterface::GET);
86+
$this->transport->write(
87+
rtrim(str_replace('index.php', '', $_ENV['app_frontend_url']), '/') . self::URL,
88+
$this->prepareParamArray(),
89+
CurlInterface::POST,
90+
[]
91+
);
7492
$serializedFiles = $this->transport->read();
7593
$this->transport->close();
76-
7794
return unserialize($serializedFiles);
7895
}
7996

8097
/**
81-
* Prepare url.
98+
* Prepare parameter array.
8299
*
83-
* @return string
100+
* @return array
84101
*/
85-
private function prepareUrl()
102+
private function prepareParamArray()
86103
{
87-
return $_ENV['app_frontend_url'] . self::URL . '?template=' . urlencode($this->template);
104+
return [
105+
'token' => urlencode($this->webapiHandler->getWebapiToken()),
106+
'template' => urlencode($this->template)
107+
];
88108
}
89109
}

‎dev/tests/functional/lib/Magento/Mtf/Util/Command/File/Export/ReaderInterface.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ interface ReaderInterface
1414
/**
1515
* Url to export.php.
1616
*/
17-
const URL = 'dev/tests/functional/utils/export.php';
17+
const URL = '/dev/tests/functional/utils/export.php';
1818

1919
/**
2020
* Exporting files as Data object from Magento.

‎dev/tests/functional/lib/Magento/Mtf/Util/Command/File/Log.php

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
namespace Magento\Mtf\Util\Command\File;
88

99
use Magento\Mtf\Util\Protocol\CurlTransport;
10+
use Magento\Mtf\Util\Protocol\CurlTransport\WebapiDecorator;
1011

1112
/**
1213
* Get content of log file in var/log folder.
@@ -16,7 +17,7 @@ class Log
1617
/**
1718
* Url to log.php.
1819
*/
19-
const URL = 'dev/tests/functional/utils/log.php';
20+
const URL = '/dev/tests/functional/utils/log.php';
2021

2122
/**
2223
* Curl transport protocol.
@@ -25,12 +26,21 @@ class Log
2526
*/
2627
private $transport;
2728

29+
/**
30+
* Webapi handler.
31+
*
32+
* @var WebapiDecorator
33+
*/
34+
private $webapiHandler;
35+
2836
/**
2937
* @param CurlTransport $transport
38+
* @param WebapiDecorator $webapiHandler
3039
*/
31-
public function __construct(CurlTransport $transport)
40+
public function __construct(CurlTransport $transport, WebapiDecorator $webapiHandler)
3241
{
3342
$this->transport = $transport;
43+
$this->webapiHandler = $webapiHandler;
3444
}
3545

3646
/**
@@ -41,22 +51,28 @@ public function __construct(CurlTransport $transport)
4151
*/
4252
public function getFileContent($name)
4353
{
44-
$curl = $this->transport;
45-
$curl->write($this->prepareUrl($name), [], CurlTransport::GET);
46-
$data = $curl->read();
47-
$curl->close();
48-
54+
$this->transport->write(
55+
rtrim(str_replace('index.php', '', $_ENV['app_frontend_url']), '/') . self::URL,
56+
$this->prepareParamArray($name),
57+
CurlInterface::POST,
58+
[]
59+
);
60+
$data = $this->transport->read();
61+
$this->transport->close();
4962
return unserialize($data);
5063
}
5164

5265
/**
53-
* Prepare url.
66+
* Prepare parameter array.
5467
*
5568
* @param string $name
56-
* @return string
69+
* @return array
5770
*/
58-
private function prepareUrl($name)
71+
private function prepareParamArray($name)
5972
{
60-
return $_ENV['app_frontend_url'] . self::URL . '?name=' . urlencode($name);
73+
return [
74+
'token' => urlencode($this->webapiHandler->getWebapiToken()),
75+
'name' => urlencode($name)
76+
];
6177
}
6278
}

‎dev/tests/functional/lib/Magento/Mtf/Util/Command/GeneratedCode.php

Lines changed: 32 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77

88
use Magento\Mtf\Util\Protocol\CurlInterface;
99
use Magento\Mtf\Util\Protocol\CurlTransport;
10+
use Magento\Mtf\Util\Protocol\CurlTransport\WebapiDecorator;
1011

1112
/**
1213
* GeneratedCode removes generated code of Magento (like generated/code and generated/metadata).
@@ -16,7 +17,7 @@ class GeneratedCode
1617
/**
1718
* Url to deleteMagentoGeneratedCode.php.
1819
*/
19-
const URL = 'dev/tests/functional/utils/deleteMagentoGeneratedCode.php';
20+
const URL = '/dev/tests/functional/utils/deleteMagentoGeneratedCode.php';
2021

2122
/**
2223
* Curl transport protocol.
@@ -25,12 +26,21 @@ class GeneratedCode
2526
*/
2627
private $transport;
2728

29+
/**
30+
* Webapi handler.
31+
*
32+
* @var WebapiDecorator
33+
*/
34+
private $webapiHandler;
35+
2836
/**
2937
* @param CurlTransport $transport
38+
* @param WebapiDecorator $webapiHandler
3039
*/
31-
public function __construct(CurlTransport $transport)
40+
public function __construct(CurlTransport $transport, WebapiDecorator $webapiHandler)
3241
{
3342
$this->transport = $transport;
43+
$this->webapiHandler = $webapiHandler;
3444
}
3545

3646
/**
@@ -40,10 +50,25 @@ public function __construct(CurlTransport $transport)
4050
*/
4151
public function delete()
4252
{
43-
$url = $_ENV['app_frontend_url'] . self::URL;
44-
$curl = $this->transport;
45-
$curl->write($url, [], CurlInterface::GET);
46-
$curl->read();
47-
$curl->close();
53+
$this->transport->write(
54+
rtrim(str_replace('index.php', '', $_ENV['app_frontend_url']), '/') . self::URL,
55+
$this->prepareParamArray(),
56+
CurlInterface::POST,
57+
[]
58+
);
59+
$this->transport->read();
60+
$this->transport->close();
61+
}
62+
63+
/**
64+
* Prepare parameter array.
65+
*
66+
* @return array
67+
*/
68+
private function prepareParamArray()
69+
{
70+
return [
71+
'token' => urlencode($this->webapiHandler->getWebapiToken())
72+
];
4873
}
4974
}

‎dev/tests/functional/lib/Magento/Mtf/Util/Command/Locales.php

Lines changed: 34 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77

88
use Magento\Mtf\Util\Protocol\CurlInterface;
99
use Magento\Mtf\Util\Protocol\CurlTransport;
10+
use Magento\Mtf\Util\Protocol\CurlTransport\WebapiDecorator;
1011

1112
/**
1213
* Returns array of locales depends on fetching type.
@@ -26,7 +27,7 @@ class Locales
2627
/**
2728
* Url to locales.php.
2829
*/
29-
const URL = 'dev/tests/functional/utils/locales.php';
30+
const URL = '/dev/tests/functional/utils/locales.php';
3031

3132
/**
3233
* Curl transport protocol.
@@ -35,12 +36,21 @@ class Locales
3536
*/
3637
private $transport;
3738

39+
/**
40+
* Webapi handler.
41+
*
42+
* @var WebapiDecorator
43+
*/
44+
private $webapiHandler;
45+
3846
/**
3947
* @param CurlTransport $transport Curl transport protocol
48+
* @param WebapiDecorator $webapiHandler
4049
*/
41-
public function __construct(CurlTransport $transport)
50+
public function __construct(CurlTransport $transport, WebapiDecorator $webapiHandler)
4251
{
4352
$this->transport = $transport;
53+
$this->webapiHandler = $webapiHandler;
4454
}
4555

4656
/**
@@ -51,12 +61,28 @@ public function __construct(CurlTransport $transport)
5161
*/
5262
public function getList($type = self::TYPE_ALL)
5363
{
54-
$url = $_ENV['app_frontend_url'] . self::URL . '?type=' . $type;
55-
$curl = $this->transport;
56-
$curl->write($url, [], CurlInterface::GET);
57-
$result = $curl->read();
58-
$curl->close();
59-
64+
$this->transport->write(
65+
rtrim(str_replace('index.php', '', $_ENV['app_frontend_url']), '/') . self::URL,
66+
$this->prepareParamArray($type),
67+
CurlInterface::POST,
68+
[]
69+
);
70+
$result = $this->transport->read();
71+
$this->transport->close();
6072
return explode('|', $result);
6173
}
74+
75+
/**
76+
* Prepare parameter array.
77+
*
78+
* @param string $type
79+
* @return array
80+
*/
81+
private function prepareParamArray($type)
82+
{
83+
return [
84+
'token' => urlencode($this->webapiHandler->getWebapiToken()),
85+
'type' => urlencode($type)
86+
];
87+
}
6288
}

0 commit comments

Comments
 (0)