test search with invalid queries

.travis.yml

@@ -0,0 +1,15 @@
+language: php
+php:
+  - '5.6'
+  - '7.0'
+  - '7.1'
+
+install:
+  - composer install --dev --no-interaction
+
+script:
+  - cd tests
+  - phpunit --coverage-clover coverage.xml --configuration phpunit.xml
+
+after_success:
+    - bash <(curl -s https://codecov.io/bash)

src/DAV/SearchPlugin.php

@@ -135,6 +135,16 @@ class SearchPlugin extends ServerPlugin {
 				}
 				/** @var BasicSearch $query */
 				$query = $xml['{DAV:}basicsearch'];
+				if (!$query->where) {
+					$response->setStatus(400);
+					$response->setBody('Parse error: Missing {DAV:}where from {DAV:}basicsearch');
+					return false;
+				}
+				if (!$query->select) {
+					$response->setStatus(400);
+					$response->setBody('Parse error: Missing {DAV:}select from {DAV:}basicsearch');
+					return false;
+				}
 				$response->setStatus(207);
 				$response->setHeader('Content-Type', 'application/xml; charset="utf-8"');
 				foreach ($query->from as $scope) {

tests/SearchPluginTest.php

@@ -196,4 +196,60 @@ class SearchPluginTest extends \PHPUnit_Framework_TestCase {
 		$expected = $parser->parse(fopen(__DIR__ . '/searchresult.xml', 'r'));
 		$this->assertEquals($expected, $parsedResponse);
 	}
+
+	public function testSearchQueryNoFrom() {
+		$this->searchBackend->expects($this->any())
+			->method('getArbiterPath')
+			->willReturn('foo');
+
+		$plugin = new SearchPlugin($this->searchBackend);
+		$server = new Server();
+		$plugin->initialize($server);
+
+		$request = new Request('SEARCH', '/index.php/foo', [
+			'Content-Type' => 'text/xml'
+		]);
+		$request->setBaseUrl('/index.php');
+		$request->setBody(fopen(__DIR__ . '/nofrom.xml', 'r'));
+		$response = new Response();
+
+		$this->searchBackend->expects($this->any())
+			->method('isValidScope')
+			->willReturn(true);
+
+		$this->searchBackend->expects($this->never())
+			->method('search');
+
+		$plugin->searchHandler($request, $response);
+
+		$this->assertEquals(400, $response->getStatus());
+	}
+
+	public function testSearchQueryNoWhere() {
+		$this->searchBackend->expects($this->any())
+			->method('getArbiterPath')
+			->willReturn('foo');
+
+		$plugin = new SearchPlugin($this->searchBackend);
+		$server = new Server();
+		$plugin->initialize($server);
+
+		$request = new Request('SEARCH', '/index.php/foo', [
+			'Content-Type' => 'text/xml'
+		]);
+		$request->setBaseUrl('/index.php');
+		$request->setBody(fopen(__DIR__ . '/nowhere.xml', 'r'));
+		$response = new Response();
+
+		$this->searchBackend->expects($this->any())
+			->method('isValidScope')
+			->willReturn(true);
+
+		$this->searchBackend->expects($this->never())
+			->method('search');
+
+		$plugin->searchHandler($request, $response);
+
+		$this->assertEquals(400, $response->getStatus());
+	}
 }

tests/phpunit.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<phpunit bootstrap="bootstrap.php">
+	<testsuite name='SearchDAV'>
+		<directory suffix='.php'>./</directory>
+	</testsuite>
+	<filter>
+		<whitelist processUncoveredFilesFromWhitelist="true">
+			<directory suffix=".php">../src</directory>
+		</whitelist>
+	</filter>
+</phpunit>