function MenuLinkContentTest::testLinkOptionsSerialization

Tests requests using a serialized field item property.

See also

https://security.drupal.org/node/161923

File

core/modules/jsonapi/tests/src/Functional/MenuLinkContentTest.php, line 199

Class

MenuLinkContentTest

JSON:API integration test for the "MenuLinkContent" content entity type.

Namespace

Code

public function testLinkOptionsSerialization() : void {
  $this->config('jsonapi.settings')
    ->set('read_only', FALSE)
    ->save(TRUE);
  $document = $this->getPostDocument();
  $document['data']['attributes']['link']['options'] = "O:44:\"Symfony\\Component\\Process\\Pipes\\WindowsPipes\":8:{s:51:\"\\Symfony\\Component\\Process\\Pipes\\WindowsPipes\x00files\";a:1:{i:0;s:3:\"foo\";}s:57:\"\x00Symfony\\Component\\Process\\Pipes\\WindowsPipes\x00fileHandles\";a:0:{}s:55:\"\x00Symfony\\Component\\Process\\Pipes\\WindowsPipes\x00readBytes\";a:2:{i:1;i:0;i:2;i:0;}s:59:\"\x00Symfony\\Component\\Process\\Pipes\\WindowsPipes\x00disableOutput\";b:0;s:5:\"pipes\";a:0:{}s:58:\"\x00Symfony\\Component\\Process\\Pipes\\AbstractPipes\x00inputBuffer\";s:0:\"\";s:52:\"\x00Symfony\\Component\\Process\\Pipes\\AbstractPipes\x00input\";N;s:54:\"\x00Symfony\\Component\\Process\\Pipes\\AbstractPipes\x00blocked\";b:1;}";
  $url = Url::fromRoute(sprintf('jsonapi.%s.collection.post', static::$resourceTypeName));
  $request_options = [];
  $request_options[RequestOptions::HEADERS]['Accept'] = 'application/vnd.api+json';
  $request_options[RequestOptions::HEADERS]['Content-Type'] = 'application/vnd.api+json';
  $request_options[RequestOptions::BODY] = Json::encode($document);
  $request_options = NestedArray::mergeDeep($request_options, $this->getAuthenticationRequestOptions());
  // Ensure 403 when unauthorized.
  $response = $this->request('POST', $url, $request_options);
  $reason = $this->getExpectedUnauthorizedAccessMessage('POST');
  $this->assertResourceErrorResponse(403, (string) $reason, $url, $response);
  $this->setUpAuthorization('POST');
  // Ensure that an exception is thrown.
  $response = $this->request('POST', $url, $request_options);
  $this->assertResourceErrorResponse(500, (string) 'The generic FieldItemNormalizer cannot denormalize string values for "options" properties of the "link" field (field item class: Drupal\\link\\Plugin\\Field\\FieldType\\LinkItem).', $url, $response);
  // Create a menu link content entity without the serialized property.
  unset($document['data']['attributes']['link']['options']);
  $request_options[RequestOptions::BODY] = Json::encode($document);
  $response = $this->request('POST', $url, $request_options);
  $document = $this->getDocumentFromResponse($response);
  $internal_id = $document['data']['attributes']['drupal_internal__id'];
  // Load the created menu item and add link options to it.
  $menu_link = MenuLinkContent::load($internal_id);
  $menu_link->get('link')
    ->first()
    ->set('options', [
    'fragment' => 'test',
  ]);
  $menu_link->save();
  // Fetch the link.
  unset($request_options[RequestOptions::BODY]);
  $url = Url::fromRoute(sprintf('jsonapi.%s.individual', static::$resourceTypeName), [
    'entity' => $document['data']['id'],
  ]);
  $response = $this->request('GET', $url, $request_options);
  $response_body = (string) $response->getBody();
  // Ensure that the entity can be updated using a response document.
  $request_options[RequestOptions::BODY] = $response_body;
  $response = $this->request('PATCH', $url, $request_options);
  $this->assertResourceResponse(200, Json::decode($response_body), $response);
}