Merge remote-tracking branch 'origin/CABPI-470' into gl_pr_arrows_adobeims_sep20_2022

Author: rimple-saini

app/code/Magento/AdobeIms/Model/Authorization.php

@@ -7,11 +7,13 @@
 
 namespace Magento\AdobeIms\Model;
 
-use Magento\AdobeImsApi\Api\ConfigInterface;
+use Laminas\Uri\Uri;
 use Magento\AdobeImsApi\Api\AuthorizationInterface;
+use Magento\AdobeImsApi\Api\ConfigInterface;
 use Magento\Framework\Exception\InvalidArgumentException;
 use Magento\Framework\HTTP\Client\Curl;
 use Magento\Framework\HTTP\Client\CurlFactory;
+use Magento\Framework\Stdlib\Parameters;
 
 /**
  * Provide auth url and validate authorization
@@ -30,16 +32,37 @@ class Authorization implements AuthorizationInterface
      */
     private CurlFactory $curlFactory;
 
+    /**
+     * @var string|null
+     */
+    private $redirectHost = null;
+
+    /**
+     * @var Parameters
+     */
+    private Parameters $parameters;
+
+    /**
+     * @var Uri
+     */
+    private Uri $uri;
+
     /**
      * @param CurlFactory $curlFactory
      * @param ConfigInterface $imsConfig
+     * @param Parameters $parameters
+     * @param Uri $uri
      */
     public function __construct(
         CurlFactory $curlFactory,
-        ConfigInterface $imsConfig
+        ConfigInterface $imsConfig,
+        Parameters $parameters,
+        Uri $uri
     ) {
         $this->curlFactory = $curlFactory;
         $this->imsConfig = $imsConfig;
+        $this->parameters = $parameters;
+        $this->uri = $uri;
     }
 
     /**
@@ -52,7 +75,10 @@ public function __construct(
     public function getAuthUrl(?string $clientId = null): string
     {
         $authUrl = $this->imsConfig->getAdminAdobeImsAuthUrl($clientId);
-        return $this->getAuthorizationLocation($authUrl);
+        $imsUrl = $this->getAuthorizationLocation($authUrl);
+        $this->validateRedirectUrls($authUrl, $imsUrl);
+
+        return $imsUrl;
     }
 
     /**
@@ -117,4 +143,48 @@ private function validateResponse(Curl $curl): void
             );
         }
     }
+
+    /**
+     * Validate current host and IMS returned host to make sure credentials belongs to correct project.
+     *
+     * @param string $authUrl
+     * @param string $imsUrl
+     * @throws InvalidArgumentException
+     */
+    private function validateRedirectUrls(string $authUrl, string $imsUrl)
+    {
+        $imsRedirectUrlHost = $this->getRedirectUrlHost($imsUrl);
+        $currentRedirectHost = $this->getRedirectUrlHost($authUrl);
+        if (!($imsRedirectUrlHost && $currentRedirectHost) || !($imsRedirectUrlHost === $currentRedirectHost)) {
+            throw new InvalidArgumentException(
+                __('Could not get a valid response from Adobe IMS Service.')
+            );
+        }
+    }
+
+    /**
+     * Get host from redirect Url
+     *
+     * @param string $imsUrl
+     * @return string|null
+     */
+    private function getRedirectUrlHost(string $imsUrl): ?string
+    {
+        $this->uri->parse($imsUrl);
+        $this->parameters->fromString($this->uri->getQuery());
+        $urlParams = $this->parameters->toArray();
+        if (!isset($urlParams['redirect_uri'])) {
+            foreach ($urlParams as $param => $value) {
+                if ($param === 'callback' || $param === 'uc_callback') {
+                    $this->getRedirectUrlHost($value);
+                } elseif ($this->redirectHost) {
+                    break;
+                }
+            }
+        } elseif (isset($urlParams['redirect_uri'])) {
+            $this->uri->parse($urlParams['redirect_uri']);
+            $this->redirectHost = $this->uri->getHost();
+        }
+        return $this->redirectHost;
+    }
 }

app/code/Magento/AdobeIms/Test/Unit/Model/GetAuthorizationUrlTest.php renamed to app/code/Magento/AdobeIms/Test/Unit/Model/AuthorizationTest.php

@@ -7,15 +7,17 @@
 
 namespace Magento\AdobeIms\Test\Unit\Model;
 
+use Laminas\Uri\Uri;
 use Magento\AdobeIms\Model\Authorization;
 use Magento\AdobeImsApi\Api\ConfigInterface;
 use Magento\Framework\Exception\InvalidArgumentException;
 use Magento\Framework\HTTP\Client\Curl;
 use Magento\Framework\HTTP\Client\CurlFactory;
+use Magento\Framework\Stdlib\Parameters;
 use Magento\Framework\TestFramework\Unit\Helper\ObjectManager as ObjectManagerHelper;
 use PHPUnit\Framework\TestCase;
 
-class GetAuthorizationUrlTest extends TestCase
+class AuthorizationTest extends TestCase
 {
     private const AUTH_URL = 'https://adobe-login-url.com/authorize' .
     '?client_id=AdobeCommerceIMS' .
@@ -26,6 +28,8 @@ class GetAuthorizationUrlTest extends TestCase
 
     private const AUTH_URL_ERROR = 'https://adobe-login-url.com/authorize?error=invalid_scope';
 
+    private const REDIRECT_URL = 'https://magento-instance.local';
+
     /**
      * @var CurlFactory
      */
@@ -35,6 +39,14 @@ class GetAuthorizationUrlTest extends TestCase
      * @var Authorization
      */
     private $authorizationUrl;
+    /**
+     * @var Parameters|\PHPUnit\Framework\MockObject\MockObject
+     */
+    private mixed $parametersMock;
+    /**
+     * @var Parameters|\PHPUnit\Framework\MockObject\MockObject
+     */
+    private mixed $uriMock;
 
     protected function setUp(): void
     {
@@ -45,16 +57,69 @@ protected function setUp(): void
             ->method('getAuthUrl')
             ->willReturn(self::AUTH_URL);
         $this->curlFactory = $this->createMock(CurlFactory::class);
-
+        $this->parametersMock = $this->createMock(Parameters::class);
+        $this->uriMock = $this->createMock(Uri::class);
+        $urlParts = [];
+        $url = self::AUTH_URL;
+        $this->uriMock->expects($this->any())
+            ->method('parse')
+            ->willReturnCallback(
+                function ($url) use (&$urlParts) {
+                    $urlParts = parse_url($url);
+                }
+            );
+        $this->uriMock->expects($this->any())
+            ->method('getHost')
+            ->willReturnCallback(
+                function () use (&$urlParts) {
+                    return array_key_exists('host', $urlParts) ? $urlParts['host'] : '';
+                }
+            );
+        $this->uriMock->expects($this->any())
+            ->method('getQuery')
+            ->willReturnCallback(
+                function () {
+                    return 'callback=' . self::REDIRECT_URL;
+                }
+            );
+        $this->parametersMock->method('fromString')
+            ->with('callback=' . self::REDIRECT_URL)
+            ->willReturnSelf();
+        $this->parametersMock->method('toArray')
+            ->willReturn([
+                'redirect_uri' => self::REDIRECT_URL
+            ]);
         $this->authorizationUrl = $objectManagerHelper->getObject(
             Authorization::class,
             [
                 'curlFactory' => $this->curlFactory,
-                'imsConfig' => $imsConfigMock
+                'imsConfig' => $imsConfigMock,
+                'parameters' => $this->parametersMock,
+                'uri' => $this->uriMock
             ]
         );
     }
 
+    /**
+     * Test IMS host belongs to correct project
+     */
+    public function testAuthUrlValidateImsHostBelongsToCorrectProject(): void
+    {
+        $curlMock = $this->createMock(Curl::class);
+        $curlMock->method('getHeaders')
+            ->willReturn(['location' => self::AUTH_URL]);
+        $curlMock->method('getStatus')
+            ->willReturn(302);
+
+        $this->curlFactory->method('create')
+            ->willReturn($curlMock);
+
+        $this->assertEquals($this->authorizationUrl->getAuthUrl(), self::AUTH_URL);
+    }
+
+    /**
+     * Test auth throws exception code when response code is 200
+     */
     public function testAuthThrowsExceptionWhenResponseCodeIs200(): void
     {
         $curlMock = $this->createMock(Curl::class);
@@ -71,6 +136,9 @@ public function testAuthThrowsExceptionWhenResponseCodeIs200(): void
         $this->authorizationUrl->getAuthUrl();
     }
 
+    /**
+     * Test auth throws exception code when response contains error
+     */
     public function testAuthThrowsExceptionWhenResponseContainsError(): void
     {
         $curlMock = $this->createMock(Curl::class);