archtechx/tenancy
1
0
Fork 0
mirror of https://github.com/archtechx/tenancy.git synced 2026-05-06 19:04:04 +00:00
Code Activity

Validate SQLite filename in databaseExists

Browse source 
Add validation so that a malicious tenant DB name can't be used to detect if a file exists.
This commit is contained in:
lukinovec 2026-04-30 09:49:03 +02:00
parent 75b74f2e6c
commit 322257f456
2 changed files with 17 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
tests/TenantDatabaseManagerTest.php
View file

@ -623,6 +623,16 @@ test('database managers validate parameters that cannot be bound', function ($dr
expect(fn () => $manager->deleteDatabase($validTenant))->not()->toThrow(InvalidArgumentException::class);
})->with('database_managers');
test('sqlite database manager validates the name in databaseExists', function () {
$manager = app(SQLiteDatabaseManager::class);
expect(fn () => $manager->databaseExists("../invalid-db-name.sqlite"))
->toThrow(InvalidArgumentException::class);
expect(fn () => $manager->databaseExists('valid-db_name.sqlite'))
->not()->toThrow(InvalidArgumentException::class);
});
// Datasets
dataset('database_managers', [
['mysql', MySQLDatabaseManager::class],