archtechx/tenancy
1
0
Fork 0
mirror of https://github.com/archtechx/tenancy.git synced 2026-05-06 18:04:03 +00:00
Code Activity

Make in-memory DB detection more strict

Browse source 
In-memory DBs have to start with "file:_tenancy_inmemory_". This prevents path traversal.
This commit is contained in:
lukinovec 2026-05-01 13:09:37 +02:00
parent b1f0d0a43c
commit 7363318f6e
2 changed files with 8 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
tests/TenantDatabaseManagerTest.php
View file

@ -615,7 +615,7 @@ test('database managers validate parameters that cannot be bound', function ($dr
}
})->with('database_managers');
test('sqlite database manager validates database filenames', function () {
test('sqlite database manager validates database names', function () {
$manager = app(SQLiteDatabaseManager::class);
// Dots are allowed in database names
@ -630,9 +630,13 @@ test('sqlite database manager validates database filenames', function () {
expect(fn () => $manager->databaseExists(''))
->toThrow(InvalidArgumentException::class);
// In-memory database names aren't validated
expect(fn () => $manager->databaseExists('../_tenancy_inmemory_'))
// In-memory database names have to start with 'file:_tenancy_inmemory_'
expect(fn () => $manager->databaseExists('file:_tenancy_inmemory_123?mode=memory&cache=shared'))
->not()->toThrow(InvalidArgumentException::class);
// Doesn't start with 'file:_tenancy_inmemory_', not considered an in-memory database, filename validation applies
expect(fn () => $manager->databaseExists('../_tenancy_inmemory_'))
->toThrow(InvalidArgumentException::class);
});
// Datasets