tom/dpl
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(security): harden registration email code validation

Browse Source
This commit is contained in:
xboard 2026-05-22 22:05:33 +08:00
parent 1eb085d4c0
commit 4e9dfd6018
2 changed files with 80 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
app/Services/Auth/RegisterService.php
View File

@ -82,10 +82,13 @@ class RegisterService
// 检查邮箱验证
if ((int) admin_setting('email_verify', 0)) {
if (empty($request->input('email_code'))) {
$emailCode = $request->input('email_code');
if (!is_scalar($emailCode) || !preg_match('/^\d{6}$/', (string) $emailCode)) {
return [false, [422, __('Email verification code cannot be empty')]];
}
if ((string) Cache::get(CacheKey::get('EMAIL_VERIFY_CODE', $request->input('email'))) !== (string) $request->input('email_code')) {
$cachedEmailCode = Cache::get(CacheKey::get('EMAIL_VERIFY_CODE', $request->input('email')));
if ($cachedEmailCode === null || !hash_equals((string) $cachedEmailCode, (string) $emailCode)) {
return [false, [400, __('Incorrect email verification code')]];
}
}

75
tests/Unit/Services/Auth/RegisterServiceTest.php Normal file
View File

@ -0,0 +1,75 @@
<?php
namespace Tests\Unit\Services\Auth;
use App\Services\Auth\RegisterService;
use App\Utils\CacheKey;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Cache;
use Tests\TestCase;
class RegisterServiceTest extends TestCase
{
use RefreshDatabase;
private RegisterService $service;
protected function setUp(): void
{
parent::setUp();
Cache::flush();
admin_setting([
'email_verify' => 1,
'email_whitelist_enable' => 0,
'email_gmail_limit_enable' => 0,
'stop_register' => 0,
'invite_force' => 0,
'captcha_enable' => 0,
'register_limit_by_ip_enable' => 0,
]);
$this->service = app(RegisterService::class);
}
public function test_validate_register_rejects_missing_cached_email_code(): void
{
[$success, $result] = $this->service->validateRegister($this->makeRequest([
'email_code' => '123456',
]));
$this->assertFalse($success);
$this->assertSame(400, $result[0]);
}
public function test_validate_register_rejects_boolean_email_code(): void
{
[$success, $result] = $this->service->validateRegister($this->makeRequest([
'email_code' => false,
]));
$this->assertFalse($success);
$this->assertSame(422, $result[0]);
}
public function test_validate_register_accepts_matching_cached_email_code(): void
{
Cache::put(CacheKey::get('EMAIL_VERIFY_CODE', 'user@example.com'), 123456, 300);
[$success, $result] = $this->service->validateRegister($this->makeRequest([
'email_code' => '123456',
]));
$this->assertTrue($success);
$this->assertNull($result);
}
private function makeRequest(array $overrides = []): Request
{
return Request::create('/api/v1/passport/auth/register', 'POST', array_merge([
'email' => 'user@example.com',
'password' => 'password123',
], $overrides));
}
}