From 70425bae12765f178cb52e6c6156d65dfee70368 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= <mauricio@fauth.dev>
Date: Sun, 25 Feb 2024 14:10:05 -0300
Subject: [PATCH 1/3] Add unit test for Session::secure()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
---
 tests/unit/SessionTest.php | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 tests/unit/SessionTest.php

diff --git a/tests/unit/SessionTest.php b/tests/unit/SessionTest.php
new file mode 100644
index 0000000000..27115aa131
--- /dev/null
+++ b/tests/unit/SessionTest.php
@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace PhpMyAdmin\Tests;
+
+use PhpMyAdmin\Session;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\PreserveGlobalState;
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+use PHPUnit\Framework\TestCase;
+
+#[CoversClass(Session::class)]
+final class SessionTest extends TestCase
+{
+    #[RunInSeparateProcess]
+    #[PreserveGlobalState(false)]
+    public function testSecure(): void
+    {
+        $_SESSION[' PMA_token '] = null;
+        $_SESSION[' HMAC_secret '] = null;
+
+        Session::secure();
+
+        /** @psalm-suppress TypeDoesNotContainType */
+        self::assertIsString($_SESSION[' PMA_token ']);
+        self::assertNotEmpty($_SESSION[' PMA_token ']);
+        /** @psalm-suppress TypeDoesNotContainType */
+        self::assertIsString($_SESSION[' HMAC_secret ']);
+        self::assertNotEmpty($_SESSION[' HMAC_secret ']);
+    }
+}

From ecafb167ee550de0ba6d2679141d2cde369e626f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= <mauricio@fauth.dev>
Date: Sun, 25 Feb 2024 14:40:00 -0300
Subject: [PATCH 2/3] Add code coverage for some value objects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
---
 tests/unit/InsertEditTest.php         | 2 ++
 tests/unit/SystemDatabaseTest.php     | 1 +
 tests/unit/VersionInformationTest.php | 1 +
 3 files changed, 4 insertions(+)

diff --git a/tests/unit/InsertEditTest.php b/tests/unit/InsertEditTest.php
index ad149e7214..45ec22edf4 100644
--- a/tests/unit/InsertEditTest.php
+++ b/tests/unit/InsertEditTest.php
@@ -42,6 +42,8 @@ use const MYSQLI_TYPE_TIMESTAMP;
 use const MYSQLI_TYPE_TINY;
 
 #[CoversClass(InsertEdit::class)]
+#[CoversClass(EditField::class)]
+#[CoversClass(InsertEditColumn::class)]
 #[Group('medium')]
 class InsertEditTest extends AbstractTestCase
 {
diff --git a/tests/unit/SystemDatabaseTest.php b/tests/unit/SystemDatabaseTest.php
index 424db67a0c..e698db264c 100644
--- a/tests/unit/SystemDatabaseTest.php
+++ b/tests/unit/SystemDatabaseTest.php
@@ -17,6 +17,7 @@ use ReflectionProperty;
 use const MYSQLI_TYPE_STRING;
 
 #[CoversClass(SystemDatabase::class)]
+#[CoversClass(SystemColumn::class)]
 class SystemDatabaseTest extends AbstractTestCase
 {
     /**
diff --git a/tests/unit/VersionInformationTest.php b/tests/unit/VersionInformationTest.php
index a80db08f68..3a5cfe2d2c 100644
--- a/tests/unit/VersionInformationTest.php
+++ b/tests/unit/VersionInformationTest.php
@@ -12,6 +12,7 @@ use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\Attributes\Group;
 
 #[CoversClass(VersionInformation::class)]
+#[CoversClass(Release::class)]
 class VersionInformationTest extends AbstractTestCase
 {
     /** @var Release[] */

From cbff3f344ebf58a9edd516021b6787e82d095f64 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= <mauricio@fauth.dev>
Date: Sun, 25 Feb 2024 15:54:12 -0300
Subject: [PATCH 3/3] Add unit tests for UrlRedirector
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
---
 psalm-baseline.xml               |  5 ++++
 tests/unit/UrlRedirectorTest.php | 48 ++++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 tests/unit/UrlRedirectorTest.php

diff --git a/psalm-baseline.xml b/psalm-baseline.xml
index 32d307c24a..4359328898 100644
--- a/psalm-baseline.xml
+++ b/psalm-baseline.xml
@@ -14972,6 +14972,11 @@
       <code><![CDATA[providerGetUniqueConditionForGroupFlag]]></code>
     </PossiblyUnusedMethod>
   </file>
+  <file src="tests/unit/UrlRedirectorTest.php">
+    <DeprecatedMethod>
+      <code><![CDATA[Config::getInstance()]]></code>
+    </DeprecatedMethod>
+  </file>
   <file src="tests/unit/UrlTest.php">
     <DeprecatedMethod>
       <code><![CDATA[Config::getInstance()]]></code>
diff --git a/tests/unit/UrlRedirectorTest.php b/tests/unit/UrlRedirectorTest.php
new file mode 100644
index 0000000000..577261e86f
--- /dev/null
+++ b/tests/unit/UrlRedirectorTest.php
@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+
+namespace PhpMyAdmin\Tests;
+
+use Fig\Http\Message\StatusCodeInterface;
+use PhpMyAdmin\Config;
+use PhpMyAdmin\ResponseRenderer;
+use PhpMyAdmin\UrlRedirector;
+use PHPUnit\Framework\Attributes\CoversClass;
+use ReflectionProperty;
+
+#[CoversClass(UrlRedirector::class)]
+final class UrlRedirectorTest extends AbstractTestCase
+{
+    public function testRedirectWithDisallowedUrl(): void
+    {
+        (new ReflectionProperty(ResponseRenderer::class, 'instance'))->setValue(null, null);
+        $GLOBALS['lang'] = 'en';
+        $config = Config::getInstance();
+        $config->settings['PmaAbsoluteUri'] = 'http://localhost/phpmyadmin';
+
+        $response = UrlRedirector::redirect('https://user:pass@example.com/');
+        self::assertSame('/phpmyadmin/', $response->getHeaderLine('Location'));
+        self::assertSame(StatusCodeInterface::STATUS_FOUND, $response->getStatusCode());
+    }
+
+    public function testRedirectWithAllowedUrl(): void
+    {
+        (new ReflectionProperty(ResponseRenderer::class, 'instance'))->setValue(null, null);
+        $GLOBALS['lang'] = 'en';
+        $_SERVER['SERVER_NAME'] = 'localhost';
+
+        UrlRedirector::redirect('https://phpmyadmin.net/');
+        $output = self::getActualOutputForAssertion();
+        $expected = <<<'HTML'
+<script>
+    window.onload = function () {
+        window.location = 'https\u003A\/\/phpmyadmin.net\/';
+    };
+</script>
+Taking you to the target site.
+HTML;
+
+        self::assertSame($expected, $output);
+    }
+}