Merge pull request #5 from k2tzumi/fix-spoof-authentication

Fix spoof authentication

Author: zerodahero

src/ValidatesOpenApiSpec.php

@@ -226,9 +226,14 @@ protected function getSpecFileType(): string
      */
     protected function getAuthenticatedRequest(SymfonyRequest $request): SymfonyRequest
     {
+        if ($request->headers->has('Authorization')) {
+            return $request;
+        }
+
+        // Spoofing when authentication headers are not present.
         $authenticatedRequest = clone $request;
         $authenticatedRequest->headers->set('Authorization', 'Bearer token');
-
+        
         return $authenticatedRequest;
     }
 

tests/ValidatesRequestsTest.php

@@ -115,6 +115,15 @@ public function provideValidationScenarios()
             ],
             true,
         ];
+
+        yield 'Authentication required' => [
+            [
+                'method' => 'GET',
+                'uri' => 'private',
+                'server' => ['HTTP_Authorization' => 'Basic MTIzNDU2Nzg5MDo='],
+            ],
+            true,
+        ];
     }
 
     private function makeRequest($method, $uri, $parameters = [], $cookies = [], $files = [], $server = [], $content = null)

tests/ValidatorBuildAndSetupTest.php

@@ -150,7 +150,23 @@ function ($faker) {
      */
     public function testBypassesAuthenticationInRequests()
     {
-        $request = $this->getAuthenticatedRequest(new SymfonyRequest());
+        $originRequest = new SymfonyRequest();
+        $request = $this->getAuthenticatedRequest($originRequest);
         $this->assertTrue($request->headers->has('Authorization'));
+        $this->assertNotSame($originRequest, $request);
+    }
+
+    /**
+     * @test
+     */
+    public function testDontSpoofAuthenticationInRequests()
+    {
+        $originRequest = new SymfonyRequest();
+        $authenticationHeaderValue = 'Basic MTIzNDU2Nzg5MDo=';
+        $originRequest->headers->set('Authorization', $authenticationHeaderValue);
+        $request = $this->getAuthenticatedRequest($originRequest);
+        $this->assertTrue($request->headers->has('Authorization'));
+        $this->assertEquals($authenticationHeaderValue, $request->headers->get('Authorization'));
+        $this->assertSame($originRequest, $request);
     }
 }

tests/fixtures/OpenAPI.yaml

@@ -72,3 +72,15 @@ paths:
       responses:
         '200':
           description: OK
+  /private:
+    get:
+      responses:
+        '200':
+          description: OK
+      security:
+        - Basic: []
+components:
+  securitySchemes:
+    Basic:
+      type: http
+      scheme: basic