Security (R6.2): Haertung nach Audit

- Security-Header-Middleware (nosniff, X-Frame-Options, Referrer-/ Permissions-Policy) global, proxy-unabhaengig; CSP bewusst separat. - Firmenlogo-Upload im Create-Formular durch den ImageService-Pfad ersetzt (Mime-Whitelist ohne SVG, Re-Encode, UUID-Name) - vorher rohe store()-Ablage ohne Server-Validierung (SVG/XSS moeglich). - Rate-Limits ergaenzt: Passwort-Reset (3/E-Mail + 15/IP pro Std.), Registrierung (10/IP pro Std.), throttle auf magic-login- und pm-vorschau-Consume-Routen (Defense-in-Depth). - EnsureUserIsCustomer als persistente Livewire-Middleware (symmetrisch zum Admin-Gate, greift auch bei Folge-Requests). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 13:43:59 +00:00 · 2026-07-03 13:43:59 +00:00 · 89550dac99
commit 89550dac99
parent acb2a19aff
9 changed files with 212 additions and 9 deletions
--- a/tests/Feature/SecurityHardeningTest.php
+++ b/tests/Feature/SecurityHardeningTest.php
@ -0,0 +1,101 @@
+<?php
+
+use App\Models\Company;
+use App\Models\User;
+use Database\Seeders\RolesAndPermissionsSeeder;
+use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\Facades\Route;
+use Illuminate\Support\Facades\Storage;
+use Livewire\Volt\Volt;
+use Tests\TestCase;
+
+test('responses carry the application-level security headers', function () {
+    /** @var TestCase $this */
+    $this->get('https://presseecho.test/de')
+        ->assertSuccessful()
+        ->assertHeader('X-Content-Type-Options', 'nosniff')
+        ->assertHeader('X-Frame-Options', 'SAMEORIGIN')
+        ->assertHeader('Referrer-Policy', 'strict-origin-when-cross-origin')
+        ->assertHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
+});
+
+test('the magic link and preview consume routes are throttled', function () {
+    $routes = Route::getRoutes();
+
+    expect($routes->getByName('magic-links.consume')->gatherMiddleware())->toContain('throttle:10,1');
+    expect($routes->getByName('press-releases.preview')->gatherMiddleware())->toContain('throttle:30,1');
+});
+
+test('password reset requests are rate limited per email', function () {
+    foreach (range(1, 3) as $i) {
+        RateLimiter::hit('password-reset|spam@example.test', 3600);
+    }
+
+    Volt::test('auth.forgot-password')
+        ->set('email', 'spam@example.test')
+        ->call('sendPasswordResetLink')
+        ->assertHasErrors(['email']);
+});
+
+test('registration is rate limited per ip', function () {
+    foreach (range(1, 10) as $i) {
+        RateLimiter::hit('register-ip|127.0.0.1', 3600);
+    }
+
+    Volt::test('auth.register')
+        ->set('name', 'Bot Bot')
+        ->set('email', 'bot@example.test')
+        ->set('password', 'super-secret-password')
+        ->set('password_confirmation', 'super-secret-password')
+        ->set('terms_accepted', true)
+        ->call('register')
+        ->assertHasErrors(['email']);
+
+    expect(User::query()->where('email', 'bot@example.test')->exists())->toBeFalse();
+});
+
+test('company create stores the logo through the image service pipeline', function () {
+    /** @var TestCase $this */
+    $this->seed(RolesAndPermissionsSeeder::class);
+    Storage::fake('public');
+
+    $admin = User::factory()->create(['is_active' => true]);
+    $admin->assignRole('admin');
+
+    Volt::actingAs($admin)
+        ->test('admin.companies.create')
+        ->set('company_name', 'Logo GmbH')
+        ->set('email', 'logo@example.test')
+        ->set('portal', 'presseecho')
+        ->set('logo', UploadedFile::fake()->image('logo.png', 400, 400))
+        ->call('save')
+        ->assertHasNoErrors();
+
+    $company = Company::query()->where('name', 'Logo GmbH')->firstOrFail();
+
+    // ImageService-Pfad (UUID-Name unter company-logos/{portal}/{id}) statt
+    // roher store()-Ablage; Varianten wurden erzeugt.
+    expect($company->logo_path)->toStartWith('company-logos/presseecho/'.$company->id.'/');
+    expect($company->logo_variants)->not->toBeNull();
+    Storage::disk('public')->assertExists($company->logo_path);
+});
+
+test('company create rejects svg logos', function () {
+    /** @var TestCase $this */
+    $this->seed(RolesAndPermissionsSeeder::class);
+    Storage::fake('public');
+
+    $admin = User::factory()->create(['is_active' => true]);
+    $admin->assignRole('admin');
+
+    Volt::actingAs($admin)
+        ->test('admin.companies.create')
+        ->set('company_name', 'SVG GmbH')
+        ->set('portal', 'presseecho')
+        ->set('logo', UploadedFile::fake()->createWithContent('logo.svg', '<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>'))
+        ->call('save')
+        ->assertHasErrors(['logo']);
+
+    expect(Company::query()->where('name', 'SVG GmbH')->exists())->toBeFalse();
+});