validator = new ThemeHooksValidator(); }); // ── scanZipForPhp tests ── test('scanZipForPhp rejects ZIP containing .php file', function () { $zipPath = sys_get_temp_dir() . '/' . uniqid() . '.zip'; $z = new ZipArchive(); $z->open($zipPath, ZipArchive::CREATE); $z->addFromString('evil.php', 'close(); $z = new ZipArchive(); $z->open($zipPath); expect(fn () => $this->validator->scanZipForPhp($z)) ->toThrow(RuntimeException::class); $z->close(); @unlink($zipPath); }); test('scanZipForPhp allows clean ZIP without PHP files', function () { $zipPath = sys_get_temp_dir() . '/' . uniqid() . '.zip'; $z = new ZipArchive(); $z->open($zipPath, ZipArchive::CREATE); $z->addFromString('theme.json', '{}'); $z->addFromString('style.css', 'body{}'); $z->close(); $z = new ZipArchive(); $z->open($zipPath); $this->validator->scanZipForPhp($z); expect(true)->toBeTrue(); // no exception = pass $z->close(); @unlink($zipPath); }); test('scanZipForPhp rejects PHP file in subfolder', function () { $zipPath = sys_get_temp_dir() . '/' . uniqid() . '.zip'; $z = new ZipArchive(); $z->open($zipPath, ZipArchive::CREATE); $z->addFromString('includes/backdoor.php', 'close(); $z = new ZipArchive(); $z->open($zipPath); expect(fn () => $this->validator->scanZipForPhp($z)) ->toThrow(RuntimeException::class); $z->close(); @unlink($zipPath); }); // ── validateHooksSource tests ── test('validateHooksSource rejects system() call', function () { $r = $this->validator->validateSource('toBeFalse(); }); test('validateHooksSource rejects exec() call', function () { $r = $this->validator->validateSource('toBeFalse(); }); test('validateHooksSource rejects eval() call', function () { $r = $this->validator->validateSource('toBeFalse(); }); test('validateHooksSource rejects file_put_contents() call', function () { $r = $this->validator->validateSource('toBeFalse(); }); test('validateHooksSource rejects shell_exec() call', function () { $r = $this->validator->validateSource('toBeFalse(); }); test('validateHooksSource allows harmless function declaration', function () { $r = $this->validator->validateSource('toBeTrue(); }); test('validateHooksSource allows array return', function () { $r = $this->validator->validateSource(' "b"];', 'clean'); expect($r['valid'])->toBeTrue(); }); test('validateHooksSource rejects inline HTML', function () { $r = $this->validator->validateSource('

x

toBeFalse(); });