Merge pull request #750 from code16/secured-embeds

Embed class validation

Author: aguingand

src/Http/Controllers/Api/Embeds/HandlesEmbed.php

@@ -9,7 +9,13 @@ trait HandlesEmbed
 {
     protected function getEmbedFromKey(string $embedKey): SharpFormEditorEmbed
     {
-        $embed = app(Str::replace('.', '\\', $embedKey));
+        $embedClass = Str::replace('.', '\\', $embedKey);
+
+        if (! is_a($embedClass, SharpFormEditorEmbed::class, true)) {
+            throw new \Exception("Embed class $embedClass is not a SharpFormEditorEmbed");
+        }
+
+        $embed = app($embedClass);
         $embed->buildEmbedConfig();
 
         return $embed;

tests/Http/Api/Embeds/ApiEmbedsFormControllerTest.php

@@ -2,6 +2,7 @@
 
 use Code16\Sharp\Auth\SharpEntityPolicy;
 use Code16\Sharp\Tests\Fixtures\Entities\PersonEntity;
+use Code16\Sharp\Tests\Fixtures\User;
 use Code16\Sharp\Tests\Http\Api\Embeds\Fixtures\ApiEmbedsFormControllerTestEmbed;
 use Illuminate\Support\Str;
 
@@ -191,3 +192,37 @@ public function view($user, $instanceId): bool
         )
         ->assertJsonValidationErrorFor('name');
 });
+
+it('fails if class is not an embed', function () {
+    $this->withoutExceptionHandling();
+
+    expect(function () {
+        $this
+            ->postJson(
+                route('code16.sharp.api.embed.instance.form.show', [
+                    'embedKey' => str(User::class)->replace('\\', '.'),
+                    'entityKey' => 'person',
+                    'instanceId' => 1,
+                ]),
+                [
+                    'name' => 'aaa',
+                ]
+            );
+    })->toThrow(Exception::class, sprintf('Embed class %s is not a SharpFormEditorEmbed', User::class));
+
+    expect(function () {
+        $this
+            ->postJson(
+                route('code16.sharp.api.embed.instance.form.update', [
+                    'embedKey' => str(User::class)->replace('\\', '.'),
+                    'entityKey' => 'person',
+                    'instanceId' => 1,
+                ]),
+                [
+                    'name' => 'aaa',
+                    'bio' => ['text' => 'aaa'],
+                ]
+            );
+    })->toThrow(Exception::class, sprintf('Embed class %s is not a SharpFormEditorEmbed', User::class));
+
+});