[10.x] Add arguments to the signed middleware to ignore properties (#…

…46987) * 10.x - Add arguments to the signed middleware to ignore properties * Fix code style * Add possibility to pass ignore parameters to the static methods * Fix code style * formatting * Update middleware to merge arguments passed to middleware to the class ignore/except list --------- Co-authored-by: Taylor Otwell <taylor@laravel.com>
laravel · May 10, 2023 · d9583ea · d9583ea
1 parent e5260fc
commit d9583ea
Show file tree

Hide file tree

Showing 2 changed files with 83 additions and 8 deletions.
diff --git a/src/Illuminate/Routing/Middleware/ValidateSignature.php b/src/Illuminate/Routing/Middleware/ValidateSignature.php
@@ -4,6 +4,7 @@
 
 use Closure;
 use Illuminate\Routing\Exceptions\InvalidSignatureException;
+use Illuminate\Support\Arr;
 
 class ValidateSignature
 {
@@ -19,41 +20,71 @@ class ValidateSignature
     /**
      * Specify that the URL signature is for a relative URL.
      *
+     * @param  array|string  $ignore
      * @return string
      */
-    public static function relative()
+    public static function relative($ignore = [])
     {
-        return static::class.':relative';
+        $ignore = Arr::wrap($ignore);
+
+        return static::class.':'.implode(',', empty($ignore) ? ['relative'] : ['relative',  ...$ignore]);
     }
 
     /**
      * Specify that the URL signature is for an absolute URL.
      *
+     * @param  array|string  $ignore
      * @return class-string
      */
-    public static function absolute()
+    public static function absolute($ignore = [])
     {
-        return static::class;
+        $ignore = Arr::wrap($ignore);
+
+        return empty($ignore)
+            ? static::class
+            : static::class.':'.implode(',', $ignore);
     }
 
     /**
      * Handle an incoming request.
      *
      * @param  \Illuminate\Http\Request  $request
      * @param  \Closure  $next
-     * @param  string|null  $relative
+     * @param  array|null  $args
      * @return \Illuminate\Http\Response
      *
      * @throws \Illuminate\Routing\Exceptions\InvalidSignatureException
      */
-    public function handle($request, Closure $next, $relative = null)
+    public function handle($request, Closure $next, ...$args)
     {
-        $ignore = property_exists($this, 'except') ? $this->except : $this->ignore;
+        [$relative, $ignore] = $this->parseArguments($args);
 
-        if ($request->hasValidSignatureWhileIgnoring($ignore, $relative !== 'relative')) {
+        if ($request->hasValidSignatureWhileIgnoring($ignore, ! $relative)) {
             return $next($request);
         }
 
         throw new InvalidSignatureException;
     }
+
+    /**
+     * Parse the additional arguments given to the middleware.
+     *
+     * @param  array  $args
+     * @return array
+     */
+    protected function parseArguments(array $args)
+    {
+        $relative = ! empty($args) && $args[0] === 'relative';
+
+        if ($relative) {
+            array_shift($args);
+        }
+
+        $ignore = array_merge(
+            property_exists($this, 'except') ? $this->except : $this->ignore,
+            $args
+        );
+
+        return [$relative, $ignore];
+    }
 }
diff --git a/tests/Integration/Routing/UrlSigningTest.php b/tests/Integration/Routing/UrlSigningTest.php
@@ -276,13 +276,52 @@ public function testSignedMiddlewareIgnoringParameter()
         }
     }
 
+    public function testSignedMiddlewareIgnoringParameterViaArgumentsWithRelative()
+    {
+        Route::get('/foo/{id}', function (Request $request, $id) {
+        })->name('foo')->middleware('signed:relative,ignore');
+
+        $this->assertIsString('https://fake.test'.URL::signedRoute('foo', ['id' => 1, 'ignore' => 'me'], null, false));
+
+        $response = $this->get('/foo/1');
+        $response->assertStatus(403);
+    }
+
+    public function testSignedMiddlewareIgnoringParameterViaArgumentsWithoutRelative()
+    {
+        Route::get('/foo/{id}', function (Request $request, $id) {
+        })->name('foo')->middleware('signed:ignore');
+
+        $this->assertIsString($url = 'https://fake.test'.URL::signedRoute('foo', ['id' => 1, 'ignore' => 'me'], null, false));
+
+        $response = $this->get('/foo/1');
+        $response->assertStatus(403);
+    }
+
+    public function testSignedMiddlewareIgnoringParameterViaClassAndArguments()
+    {
+        Route::get('/foo/{id}', function (Request $request, $id) {
+        })->name('foo')->middleware(IgnoreParameterMiddleware::relative('test'));
+
+        $this->assertIsString($url = 'https://fake.test'.URL::signedRoute('foo', ['id' => 1, 'ignore' => 'me', 'test' => 'bar'], null, false));
+
+        $response = $this->get('/foo/1');
+        $response->assertStatus(403);
+    }
+
     public function testItCanGenerateMiddlewareDefinitionViaStaticMethod()
     {
         $signature = (string) ValidateSignature::relative();
         $this->assertSame('Illuminate\Routing\Middleware\ValidateSignature:relative', $signature);
 
         $signature = (string) ValidateSignature::absolute();
         $this->assertSame('Illuminate\Routing\Middleware\ValidateSignature', $signature);
+
+        $signature = (string) ValidateSignature::relative(['foo', 'bar']);
+        $this->assertSame('Illuminate\Routing\Middleware\ValidateSignature:relative,foo,bar', $signature);
+
+        $signature = (string) ValidateSignature::absolute(['foo', 'bar']);
+        $this->assertSame('Illuminate\Routing\Middleware\ValidateSignature:foo,bar', $signature);
     }
 
     protected function createValidateSignatureMiddleware(array $ignore)
@@ -323,3 +362,8 @@ public function resolveChildRouteBinding($childType, $routeKey, $field = null)
         //
     }
 }
+
+class IgnoreParameterMiddleware extends ValidateSignature
+{
+    protected $ignore = ['ignore'];
+}