diff --git a/src/Authentication/AllowedHostsValidator.php b/src/Authentication/AllowedHostsValidator.php index 2f081ae..3dbdb61 100644 --- a/src/Authentication/AllowedHostsValidator.php +++ b/src/Authentication/AllowedHostsValidator.php @@ -8,6 +8,8 @@ namespace Microsoft\Kiota\Abstractions\Authentication; +use InvalidArgumentException; + /** * Class AllowedHostsValidator * @@ -40,6 +42,9 @@ public function setAllowedHosts(array $hosts): void { foreach ($hosts as $host) { $host = strtolower(trim($host)); + if (str_starts_with($host, "https://") || str_starts_with($host, 'http://')) { + throw new InvalidArgumentException("The host $host is not valid as it contains the scheme."); + } if (!array_key_exists($host, $this->allowedHosts)) { $this->allowedHosts[$host] = true; } @@ -81,4 +86,4 @@ private function extractHost(string $url): string throw new \InvalidArgumentException("$url must contain host"); } } -} \ No newline at end of file +} diff --git a/tests/Authentication/AllowedHostsValidatorTest.php b/tests/Authentication/AllowedHostsValidatorTest.php index fee9e23..2af7a8c 100644 --- a/tests/Authentication/AllowedHostsValidatorTest.php +++ b/tests/Authentication/AllowedHostsValidatorTest.php @@ -31,6 +31,16 @@ public function testSetAllowedHostsSetLowercaseTrimmedDeduplicatedHosts(): void $this->assertEquals($expected, $validator->getAllowedHosts()); } + public function testShouldThrowException(): void + { + $hosts = ["https://abc.com "]; + $this->expectException(\InvalidArgumentException::class); + $validator = new AllowedHostsValidator(); + $validator->setAllowedHosts($hosts); + $expected = ["abc.com"]; //duplicates should not be added to allowed hosts + + } + public function testIsUrlHostValidWithValidHost(): void { $this->assertTrue($this->defaultValidator->isUrlHostValid("https://abc.com"));